Validate third party ssl splunk2splunk communication

[vasanthmss]

Hi splunkers

I've configured 3rd party ssl between indexer and h.f. indexer 9997 open for tcp, 9996 for ssl. I've configured output confs for 9996 and sent the data . I could not see any internal logs as like wiki(older version). There is no updated document version for Splunk 2 Splunk third party ssl validation. I'm using 6.2.1 build for indexer and h.f.

Any idea how to validate that the data sent from h.f is encrypted?

Thanks
V

[jworthington_sp · Accepted solution]

I'm not clear on your exact configuration, but it sounds like you are doing some indexing on the heavy forwarder and want to know how to validate the forwarder to Splunk connection? If that is the case, this topic might help: http://docs.splunk.com/Documentation/Splunk/latest/Security/Validateyourconfiguration