Getting Data In

How to send syslog using rsyslog over TCP encrypted with TLS?

Path Finder

Hello All,

Currently a certain application is sending the data to splunk via syslog method(rsyslog) using TCP, so now the application team want to try and send the data using the syslog (rsyslog) over TCP with TLS encryption, 

Can any one please help me how this can be achieved, and it would be really awesome if anybody can provide leads on any splunk documentation or links available for reference. 


Labels (4)
0 Karma


Hi @im_bharath 

There's some information here:

Basically, configure a tcp-ssl stanza in the inputs.conf file on the receiving Splunk server:


You'll need to put the public SSL/TLS cert for the rsyslog server on the Splunk receiver and configure these too (ensure the certs are readable to the Splunk process).  It's likely you'll need to configured the cert parameters under your tcp-ssl stanza (not the global SSL stanza) for this single TCP TLS port.  Ensure the Splunk receiver is restarted once configured too.

Once configured right you should be able to test the Splunk receiving port is configured and listening for incoming encrypted  data OK using openssl, e.g.

On a *NIX server

splunk$ echo | openssl s_client -connect <splunk receiver>:<port> 2>/dev/null | openssl x509 -noout -subject -dates

Hope this helps to get you started.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...