Getting Data In

Squid proxy & universal forwarder

willemjongeneel
Communicator

Hello,

I'm trying to send data from a directory on a server to Splunk Cloud using the universal forwarder. This traffic goes through a squid proxy. I've tried to configure the proxy in server.conf:

[proxyConfig]
http_proxy = http//:8080
https_proxy = https//:8080

Port 8080 is open for tcp traffic.

I am able to connect from the server to the proxy using telnet, I am not able to connect to the indexers using telnet, however this should be possible while connecting from the universal forwarder using the forwarder credentials package, right?

The forwarder seems to be unable to connect to the indexers. splunkd file has the following warnings:

TcpOutputProc - 'sslCertPath' deprecated; use 'clientCert' instead..
Cooked connection to ip=:9997 timed out.

In the splunkd text file I don't see anything about the proxy I configured either, should this show in the splunkd file?

Does anyone have an idea on how to troubleshoot this issue?

Thanks, kind regards,
Willem Jongeneel

0 Karma

dhihoriya_splun
Splunk Employee
Splunk Employee

Hi @willemjongeneel

To connect with indexer from Splunk UF you have to add SSL cert configuration in outputs.conf file of the UF:

[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = your indexer DNS: port on which you want to send the data

sslCertPath = *******
sslRootCAPath = *********
sslPassword = ********

sslCommonNameToCheck = ********
sslVerifyServerCert = true
useClientSSLCompression = true
0 Karma

willemjongeneel
Communicator

Hello,

Shouldnt these configurations come from the universal forwarder credential package in managed splunk cloud?

Kind regards,
Willem

0 Karma

dhihoriya_splun
Splunk Employee
Splunk Employee

No, It will not come with universal forwarder credential package in managed Splunk cloud. We have to add explicitly in UF.

0 Karma

willemjongeneel
Communicator

Can you tell me where I can find this information? If I am connecting from UF to the indexers from servers that do not connect through a proxy, I never have to add this to the outputs.conf. Also, should it be in etc/apps/SplunkUniversalForwarder/default/outputs.conf ?

Thanks, kind regards,
Willem

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...