Getting Data In

Why are there different names for inputs.conf and outputs.conf?

ddrillic
Ultra Champion

On the outputs.conf of the forwarder we use sslPassword, sslCertPath and sslRootCAPath while the inputs.conf refers to the same exact configurations via password, serverCert and rootCA.

Why is that?

0 Karma
1 Solution

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

View solution in original post

ddrillic
Ultra Champion
0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

ddrillic
Ultra Champion

Much appreciated Jen.

0 Karma

ddrillic
Ultra Champion

Really interesting as I took the Admin 7.0 class in March and in the associated pdf we see -

alt text

0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Interesting! I will reach out to education and see what is going on.

ddrillic
Ultra Champion

Thank you @jworthington - let's please keep in mind that the pdfs for the various classes are sensational ; -)

0 Karma

ddrillic
Ultra Champion

For the record, we are "stuck" here in our place with sslCertPath for backward compatibility since we still have forwarders older than 6.5.2. They will not work with clientCert.

0 Karma
Get Updates on the Splunk Community!

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...