Getting Data In

Syslog SSL - FortiWeb Cloud to Splunk Enterprise

solg
Explorer

We need to connect a FortiWeb Cloud with a Splunk Heavy Forwarder.

It is over internet so SSL must be used.

We are receiving the test event correctly using TCP (without SSL)

solg_0-1735912397723.png

But it is not being decrypted with SSL

solg_1-1735912463382.png

Reviewing the documentation, we do not undesrtand how to configure the ssl-tcp input, and what certificates should be configured in FortiWeb.

We have seen some solutions centered in SSL between Splunk components, but none of them explain what certificates should be configured on the source.

Does anyone know how to make this work? With FortiWeb or any other third party input

Labels (3)
0 Karma
1 Solution

solg
Explorer

We succesfully configured FortiWeb SaaS -> Splunk SSL syslog via inputs.conf

[tcp-ssl:6514]
index = <index>
sourcetype = fwbcld_log
disabled = 0

[SSL]
requireClientCert = false

View solution in original post

0 Karma

solg
Explorer

We succesfully configured FortiWeb SaaS -> Splunk SSL syslog via inputs.conf

[tcp-ssl:6514]
index = <index>
sourcetype = fwbcld_log
disabled = 0

[SSL]
requireClientCert = false

0 Karma

kiran_panchavat
Influencer

@solg 

I believe the link below will assist you with your question.

https://community.splunk.com/t5/Security/TCP-Data-Input-and-SSL/m-p/483077 

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...