Getting Data In

Why are there different names for inputs.conf and outputs.conf?

ddrillic
Ultra Champion

On the outputs.conf of the forwarder we use sslPassword, sslCertPath and sslRootCAPath while the inputs.conf refers to the same exact configurations via password, serverCert and rootCA.

Why is that?

0 Karma
1 Solution

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

View solution in original post

ddrillic
Ultra Champion
0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

ddrillic
Ultra Champion

Much appreciated Jen.

0 Karma

ddrillic
Ultra Champion

Really interesting as I took the Admin 7.0 class in March and in the associated pdf we see -

alt text

0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Interesting! I will reach out to education and see what is going on.

ddrillic
Ultra Champion

Thank you @jworthington - let's please keep in mind that the pdfs for the various classes are sensational ; -)

0 Karma

ddrillic
Ultra Champion

For the record, we are "stuck" here in our place with sslCertPath for backward compatibility since we still have forwarders older than 6.5.2. They will not work with clientCert.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...