Getting Data In

Why are there different names for inputs.conf and outputs.conf?

ddrillic
Ultra Champion

On the outputs.conf of the forwarder we use sslPassword, sslCertPath and sslRootCAPath while the inputs.conf refers to the same exact configurations via password, serverCert and rootCA.

Why is that?

0 Karma
1 Solution

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

View solution in original post

ddrillic
Ultra Champion
0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

ddrillic
Ultra Champion

Much appreciated Jen.

0 Karma

ddrillic
Ultra Champion

Really interesting as I took the Admin 7.0 class in March and in the associated pdf we see -

alt text

0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Interesting! I will reach out to education and see what is going on.

ddrillic
Ultra Champion

Thank you @jworthington - let's please keep in mind that the pdfs for the various classes are sensational ; -)

0 Karma

ddrillic
Ultra Champion

For the record, we are "stuck" here in our place with sslCertPath for backward compatibility since we still have forwarders older than 6.5.2. They will not work with clientCert.

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...