Getting Data In

What's the best way to securely forward data from a Universal Forwarder to a Splunk Indexer?

TitanAE
New Member

Hey Everyone,

Hope your week is going well. I'm currently working to securely forward data from a Universal Forwarder to a Splunk Indexer.

I'm aware the universal forwarder can connect via SSL, but I'm hoping to find another way to secure the transmission.

Currently looking at HTTP Event Collector (HEC), with which I saw that I can generate a token within Splunk and add it to the forwarder. So that would be another possible way of securing the transmission of data to Splunk.

Are there any additional ways that I'm not seeing?

TitanAE

0 Karma

Ranazar
Path Finder

Both the Universal Forwarder and HEC use SSL to encrypt the in-flight data (you should replace the default certs). It sounds like you want an authentication method - like the HEC tokens - for the UF.

I've never used it myself, but it looks like the UF also has authentication tokens that you can use. Here's the link to that section of the documentation. It looks very similar to HEC (but there's apparently no GUI method to configure it).

0 Karma

marycordova
SplunkTrust
SplunkTrust
  1. use regular TCP transport with SSL (as you already noted)
  2. use HTTP transport with HEC (which you also noted) + SSL = HTTPS
@marycordova
0 Karma

gjanders
SplunkTrust
SplunkTrust

Why would you want to avoid the Splunk to Splunk + SSL / TLS communication?

0 Karma

TitanAE
New Member

I'm not trying to avoid it. I'm trying to see if there is anything I can do in addition to SSL/TLS communication.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...