Getting Data In

How should I configure the Stream app to have streamfwd not use SSL when connecting to HEC endpoints?

cnestrud
Explorer

I am trying to use Splunk Stream with the HTTP Event Collector. I have set HEC to not use SSL. In inputs.conf on the servers with HEC enabled:

[http]
disabled=0
enableSSL=0

The HEC URLs are entered as http://host:port in the Stream app configuration. When the standalone streamfwd is run it gets the correct URLs from the stream app but it looks like it tries to use SSL.

From streamfwd.log:

2017-02-13 15:38:58 WARN 140663285286656 stream.SplunkSenderHTTPEventCollector - (#39) SSL handshake failed: unknown protocol

The HEC endpoints are on different servers from the SHC which has the Stream app. The streamfwd binary is on a separate server without Splunk.

0 Karma
1 Solution

vshcherbakov_sp
Splunk Employee
Splunk Employee

You can check the HEC endpoints streamfwd is using by navigating to http://streamfwd-host:8889. By default this endpoint is only accessible from the same host (ie http://localhost:8889), but can be changed by adding ipAddr=0.0.0.0 param to `streamfwd.conf.

This will open an internal debugging/monitoring web interface. From there, click on the [Stats] link on the white splunk box and check the returned JSON file. HEC endpoints are presented as "indexers" array, e.g.:

...
indexers": [
"https://hec-host1:8088",
"https://hec-host2:8088",
...
"https://hec-hostn:8088",
]
}

Check if this data matches the expected protocol/host list.

PS: be careful not to leave it open after you're done with the troubleshooting (for security concerns, etc).

View solution in original post

0 Karma

vshcherbakov_sp
Splunk Employee
Splunk Employee

You can check the HEC endpoints streamfwd is using by navigating to http://streamfwd-host:8889. By default this endpoint is only accessible from the same host (ie http://localhost:8889), but can be changed by adding ipAddr=0.0.0.0 param to `streamfwd.conf.

This will open an internal debugging/monitoring web interface. From there, click on the [Stats] link on the white splunk box and check the returned JSON file. HEC endpoints are presented as "indexers" array, e.g.:

...
indexers": [
"https://hec-host1:8088",
"https://hec-host2:8088",
...
"https://hec-hostn:8088",
]
}

Check if this data matches the expected protocol/host list.

PS: be careful not to leave it open after you're done with the troubleshooting (for security concerns, etc).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...