Getting Data In

Why SSL status show as "false" despite configuring SSL

VK18
Explorer

Why SSL status show as "false" despite configuring SSL. In Our environment we have enabled TLS configuration between forwarders and receivers. The connection is established and we could see data is coming through secure TLS channel into splunk.

I have validated manually as well using openssl client module and verification was successful with status ok.

We could see for the hosts, SSL as false and it keeps changing at random times to True or False. And connection type is cookedSSL for the False host.

VK18_0-1694514825029.png

 

I have checked all the tcpoutputproc and tcpinputproc in splunkd logs, cannot find any errors related to SSL.

 

But found below WARN messages on one of the forwarders. Is this causing the problem ?

VK18_0-1694515204040.png

Any leads on this.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...