Getting Data In

Why SSL status show as "false" despite configuring SSL

VK18
Explorer

Why SSL status show as "false" despite configuring SSL. In Our environment we have enabled TLS configuration between forwarders and receivers. The connection is established and we could see data is coming through secure TLS channel into splunk.

I have validated manually as well using openssl client module and verification was successful with status ok.

We could see for the hosts, SSL as false and it keeps changing at random times to True or False. And connection type is cookedSSL for the False host.

VK18_0-1694514825029.png

 

I have checked all the tcpoutputproc and tcpinputproc in splunkd logs, cannot find any errors related to SSL.

 

But found below WARN messages on one of the forwarders. Is this causing the problem ?

VK18_0-1694515204040.png

Any leads on this.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...