Getting Data In

inputs.conf and outputs.conf for SSL encryption

chintan_shah
Path Finder

Hi,
Can someone share with me the recent inputs & outputs conf file for SSL encryption? I am having some trouble for securing the connection between forwarder and indexer.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi chintan_shah,
this is an example that I used:
outputs.conf on Forwarders

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://xx.xxx.xxx.xxx:9997]
[tcpout-server://yy.yyy.yyy.yyy:9997]

[tcpout:default-autolb-group]
server = xx.xxx.xxx.xxx:9997, yy.yyy.yyy.yyy:9997
disabled=false
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
useACK=true
disabled = false

inputs.conf on Indexers

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = password
requireClientCert = false

This is a default configuration that you can modify following https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/AboutsecuringyourSplunkconfigurationwith... .
Obvioulsy change password!

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi chintan_shah,
this is an example that I used:
outputs.conf on Forwarders

[tcpout]
defaultGroup = default-autolb-group

[tcpout-server://xx.xxx.xxx.xxx:9997]
[tcpout-server://yy.yyy.yyy.yyy:9997]

[tcpout:default-autolb-group]
server = xx.xxx.xxx.xxx:9997, yy.yyy.yyy.yyy:9997
disabled=false
sslCertPath = $SPLUNK_HOME/etc/auth/server.pem
sslPassword = password
sslRootCAPath = $SPLUNK_HOME/etc/auth/cacert.pem
sslVerifyServerCert = false
useACK=true
disabled = false

inputs.conf on Indexers

[SSL]
serverCert = $SPLUNK_HOME/etc/auth/server.pem
password = password
requireClientCert = false

This is a default configuration that you can modify following https://docs.splunk.com/Documentation/Splunk/7.0.0/Security/AboutsecuringyourSplunkconfigurationwith... .
Obvioulsy change password!

Bye.
Giuseppe

kunalmao
Communicator

https://answers.splunk.com/answers/397/how-to-configure-ssl-for-forwarding-and-receiving-data.html

just look at this answer, hope it helps.

Please let me know if this solution does not fit you.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...