Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Indexers SSL Error on 127.0.0.1 (localhost)
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
04-30-2015 09:05:03.570 -0700 ERROR TcpInputProc - Error encountered for connection from src=127.0.0.1:35742. error:1407609C:SSL routines:SSL23_GET_CLIENT_HELLO:http request
I'm seeing this error on all my indexers. I have both clustered indexers and non-clustered indexers and they all log about SSL errors to themselves (ie 127.0.0.1).
I use SSL for inputs.conf on all indexers and I'm still receiving data from forwarders and search heads. Any idea why this is happening?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It appears the error was due to Search Head Cluster replication not working with DB Connect 2.
I used deployer to deploy the app (base app no config changes), then configured DB Connect 2 on one SH Cluster peer. It did not replicate any settings or configuration. After hitting each SH Cluster member (and captain), the errors stopped.
The problem however is that my identities and connections dont show up in the UI after replication. Weird...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It appears the error was due to Search Head Cluster replication not working with DB Connect 2.
I used deployer to deploy the app (base app no config changes), then configured DB Connect 2 on one SH Cluster peer. It did not replicate any settings or configuration. After hitting each SH Cluster member (and captain), the errors stopped.
The problem however is that my identities and connections dont show up in the UI after replication. Weird...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
inputs.conf on indexer:
[splunktcp-ssl:9998]
compressed = true
connection_host = none
[SSL]
password = $1$G9OzOtJKYpts
requireClientCert = false
rootCA = $SPLUNK_HOME/etc/auth/cacert.pem
serverCert = $SPLUNK_HOME/etc/auth/server.pem
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
