Getting Data In

HttpEventCollectorLogbackAppender - How do I configure it to verify certs?

MikeSplunkHEC
Engager

I can send events to Splunk cloud and Splunk Enterprise servers with HttpEventCollectorLogbackAppender, but with SSL not enabled.

I need to do this with SSL Enabled for my HEC connection.  I need to send events over a secure connection from my java application to Splunk Enterprise. I need to configure my HttpEventCollector to verify certs.

 
How do I configure my HttpEventCollectorLogbackAppender to use a certificate?
I only see code examples wit 
disableCertificateValidation="true" 
 
How do I specify verify with my certificate?  Have you a code example please?
Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not a java guru, but from what I see in the sources, if you don't set the disabling option, the HttpEventCollectorSender creates a httpSharedClient which should just use default java SSL mechanisms (socket factory, trust manager and so on). By default it should on its own simply verify peer's certificate validity using default java truststore.

I don't see at first glance however whether you can force the sender to present a client certificate to the server for authentication.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...