Getting Data In

Can we configure some Universal Forwarders to forward data to port 9998 with SSL on indexers and the remaining Universal Forwarders to forward data to port 9997 without SSL on same indexers?

Contributor

Can we configure some Universal Forwarders to forward data to port 9998 with SSL on indexers and the remaining Universal Forwarders to forward data to port 9997 without SSL on same indexers? If yes, what do we need to configure?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi ankithreddy777,
Yes you can:
you have to configure your forwarders with two different outputs.conf: one with SSL and port 9998 and one without SSL and port 9997.
in you indexers you have to modify inputs.conf and serve.conf file as described in https://docs.splunk.com/Documentation/Splunk/6.5.1/Security/ConfigureSplunkforwardingtousethedefault...
You have to create two stanzas:
[splunktcp-ssl:9998]
[splunktcp:9997]

Bye.
Giuseppe

View solution in original post

SplunkTrust
SplunkTrust

Hi ankithreddy777,
Yes you can:
you have to configure your forwarders with two different outputs.conf: one with SSL and port 9998 and one without SSL and port 9997.
in you indexers you have to modify inputs.conf and serve.conf file as described in https://docs.splunk.com/Documentation/Splunk/6.5.1/Security/ConfigureSplunkforwardingtousethedefault...
You have to create two stanzas:
[splunktcp-ssl:9998]
[splunktcp:9997]

Bye.
Giuseppe

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!