Getting Data In

Can SSL be configured when sending data to Universal Forwarder through TCP connection from an external source?


Data is sent to Splunk Universal Forwarder (UF) through the TCP connection. From UF, data is forwarded to indexers. As we know SSL is supported by Splunk when Data is sent to Indexers. But can SSL be configured when sending data to Splunk UF through TCP connection from an external source?

0 Karma


As per Get data from TCP and UDP ports refer to :

Configure a TCP input over SSL


Use this stanza type if you receive
encrypted, unparsed data from a
forwarder or third-party system. Set
to the port on which the
forwarder or third-party system is
sending unparsed, encrypted data.

So yes the universal forwarder can use a tcp-ssl stanza to receive encrypted SSL traffic as a listener...

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...