Our anti-virus application is located in the "cloud" and is sending syslog data to the indexer over TCP port 6514. The application has the ability to use SSL to encrypt this data. Looking at previous answers, it looks like I should add [tcp-ssl://6514] to \etc\system\local\inputs.conf. After modifing the config and changing the remote end to use SSL, I get gibberish like this -
index = avprogram source = tcp:6514 sourcetype = syslog
When I remove the SSL requirement from the remote end, the data shows up as correct. It looks to me that I am missing a setting to decrypt the incoming data.
Any suggestions on what I need to do?
Are you sure the TCP-SSL input is actually running properly? Did you remove the old TCP input config? Sounds like both are still in place and since splunk can only have 1 input on a TCP port, it picks the plain TCP input.
Try disabling/removing the old TCP input, or run the new input on another port, so you're sure you're troubleshooting the TCP-SSL input.
To get this to work, I had to remove the existing TCP input and add both the tcp-ssl and ssl sections.
So that solved it? Or you mean you did that already before you encountered this problem of receiving gibberish?
To solve the issue, in inputs.conf
Removed [tcp://6514] stanza
connection_host = dns
sourcetype = syslog
index = avprogram
rootCA = E:\Splunk\etc\auth\cacert.pem
serverCert = E:\Splunk\etc\auth\server.pem
password = *******************
Note: I had to add the entire path because this is a Windows system.