How to configure Splunk forwarder to encrypt data?

[plenderj]

I have recently (yesterday) installed a new instance of Splunk on a VM.
Another VM in a separate datacentre has the Splunk forwarder installed on it.

Whilst the data being indexed isn't highly sensitive, I'd like to have the data encrypted anyway as it's passing over the public internet.

What's the minimum/easiest/quickest way to get encryption up and running?

[MuS · Accepted solution]

Hi plenderj,

enable SSL communication between universal forwarder and indexer is the fastest and easiest way. Read more about it in the docs about About securing data from forwarders.

hope this helps ...

cheers, MuS

[VatsalJagani]

Update 2023-06-09

The latest link for data encryption from forwarder to indexer - https://docs.splunk.com/Documentation/Splunk/latest/Security/ConfigureSplunkforwardingtousesignedcer... 

[johnebgood]

This link is now dead, found updated link:

http://docs.splunk.com/Documentation/Splunk/latest/Security/Aboutsecuringdatafromforwarders

[MuS]

Thanks for the new link. Over time and version changes, some Splunk doc links stopped working.

[plenderj]

Works like a charm 🙂