Getting Data In

inputs.conf and outputs.conf for SSL encryption

chintan_shah
Path Finder

Hi,
Can someone share with me the recent inputs & outputs conf file for SSL encryption? I am having some trouble for securing the connection between forwarder and indexer.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi chintan_shah,
this is an example that I used:
outputs.conf on Forwarders

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://xx.xxx.xxx.xxx:9997]
[tcpout-server://yy.yyy.yyy.yyy:9997]

[tcpout:default-autolb-group]
server = xx.xxx.xxx.xxx:9997, yy.yyy.yyy.yyy:9997
disabled=false
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
useACK=true
disabled = false

inputs.conf on Indexers

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = password
requireClientCert = false

This is a default configuration that you can modify following https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/AboutsecuringyourSplunkconfigurationwith... .
Obvioulsy change password!

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi chintan_shah,
this is an example that I used:
outputs.conf on Forwarders

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://xx.xxx.xxx.xxx:9997]
[tcpout-server://yy.yyy.yyy.yyy:9997]

[tcpout:default-autolb-group]
server = xx.xxx.xxx.xxx:9997, yy.yyy.yyy.yyy:9997
disabled=false
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
useACK=true
disabled = false

inputs.conf on Indexers

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = password
requireClientCert = false

This is a default configuration that you can modify following https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/AboutsecuringyourSplunkconfigurationwith... .
Obvioulsy change password!

Bye.
Giuseppe

kunalmao
Communicator

https://answers.splunk.com/answers/397/how-to-configure-ssl-for-forwarding-and-receiving-data.html

just look at this answer, hope it helps.

Please let me know if this solution does not fit you.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...