Getting Data In

Can I enable SSL for a universal forwarder (public IP), but not for a local universal forwarder (private IP)?

arbabnazar
New Member

Hi,

Can I enable the SSL for the universal forwarder that will access it through the public ip, but not the forwarder that accesses Splunk from its private ip? Is it possible?

Thanks,

0 Karma

lguinn2
Legend

Yes - but you need to think about the indexers as well. On the indexer, you can have a receiving port that uses SSL. You can also have a receiving port that does not - but you can't have a single port that does both. So set up 2 ports: let's say 9995 for SSL and 9996 for non-SSL. Of course, you have to do the SSL setup for port 9995.

Then on the forwarder, you can have more than one stanza in outputs.conf - when you are sending to port 9995, you have to specify the SSL options. When you forward to port 9996, you don't need those options.

There is more information here:
Configure Splunkforwarding to use signed certificates
Splunk wiki article on using default certs

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...