Getting Data In

Why are there different names for inputs.conf and outputs.conf?

ddrillic
Ultra Champion

On the outputs.conf of the forwarder we use sslPassword, sslCertPath and sslRootCAPath while the inputs.conf refers to the same exact configurations via password, serverCert and rootCA.

Why is that?

0 Karma
1 Solution

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

View solution in original post

ddrillic
Ultra Champion
0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Hi ddrillic,

You are definitely looking at an old version of the spec files. Are you working with a version of Splunk that is earlier than 6.4?

In the later versions of Splunk:

  • "sslCertPath" is deprecated, we now use "clientCert" instead
  • "sslRootCAPath" has been deprecated entirely.

In inputs.conf

  • "rootCA" is deprecated.

I do think there are probably some things we can do to make the files more compatible, I'm working with dev on that. Thank you for bringing this up.

Thanks,
jen

ddrillic
Ultra Champion

Much appreciated Jen.

0 Karma

ddrillic
Ultra Champion

Really interesting as I took the Admin 7.0 class in March and in the associated pdf we see -

alt text

0 Karma

jworthington_sp
Splunk Employee
Splunk Employee

Interesting! I will reach out to education and see what is going on.

ddrillic
Ultra Champion

Thank you @jworthington - let's please keep in mind that the pdfs for the various classes are sensational ; -)

0 Karma

ddrillic
Ultra Champion

For the record, we are "stuck" here in our place with sslCertPath for backward compatibility since we still have forwarders older than 6.5.2. They will not work with clientCert.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...