Getting Data In
Highlighted

Unable to connect Splunk HEC using https

New Member

Hi
I'm trying to push logs to Splunk using Splunk HTTP appender in Log4j.
If I disable SSL in HTTP event Collector Global Settings, I can push the logs to Splunk successfully whereas if I enable SSL, I cannot see any logs. Is there some configuration missing as part of my log4j ? Please help.

mule:log.splunk.url : http://localhost:8088 --> disabling SSL
mule:log.splunk.url : https://localhost:8088 --> enabling SSL

<SplunkHttp name="splunk" url="${mule:log.splunk.url}" 
                token="${mule:log.splunk.token}" batch_size_count="1" disableCertificateValidation="true" >
             <JSONLayout complete="false" compact="false">
                <KeyValuePair key="timestamp" value="$${date:MM-dd-yyyy}"/>
                <KeyValuePair key="api_name" value="${mule:log.api.name}"/>
                <KeyValuePair key="api_version" value="${mule:log.api.version}"/>
                <KeyValuePair key="api_type" value="${mule:log.api.type}"/>
                <KeyValuePair key="api_domain" value="${sys:domain}"/>
                <KeyValuePair key="api_worker_index" value="${sys:worker.id}"/>
            </JSONLayout> 
        </SplunkHttp>
0 Karma
Highlighted

Re: Unable to connect Splunk HEC using https

Builder

from Splunk docs inputs.conf

enableSSL = [0|1]
* Whether or not the HTTP Event Collector uses SSL.
* HEC shares SSL settings with the Splunk management server and cannot have
  SSL enabled when the Splunk management server has SSL disabled.
* Default: 1 (enabled).

serverCert = 
* The full path to the server certificate PEM format file.
* The same file may also contain a private key.
* The Splunk software automatically generates certificates when it first
  starts.
* You may replace the auto-generated certificate with your own certificate.
* Default: $SPLUNK_HOME/etc/auth/server.pem.

sslPassword = 
* The server certificate password.
* Initially set to a plain-text password.
* Upon first use, Splunk software encrypts and rewrites the password.
* Default: "password".

you have to configure above under stanza [http://] on the Splunk Enterprise where you have enabled HEC.

No point having Splunk internal certificates as sslPassword is known to all. Try to use 3rd party certificates.

refer below if you have any doubts.

https://answers.splunk.com/answers/462131/securing-http-event-collector.html

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.