Security

Encryption in distributed search

msarro
Builder

Greetings, I am just trying to find out if there is any sort of security/encryption between the Indexer and Search head when using a distributed search? Or is data transferred in an unencrypted way between the indexer and search head?

Tags (1)
0 Karma
1 Solution

dwaddle
SplunkTrust
SplunkTrust

Distributed search uses each search peer's splunkd REST port, which is by default encrypted using SSL. Unless you went out of your way to specifically disable Splunk's SSL support, it should be encrypted already.

That said, the default out-of-the-box Splunk setup either generates a self-signed certificate or uses one provided with Splunk. Either way, it's not the most robust from an SSL point of view. You can (and should) generate your own key and CSR and get a new certificate issues for production installs. (It doesn't have to be a "commercial" CA - you can use an internal CA for the purpose. The point is to not just use the default certificate. )

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

Distributed search uses each search peer's splunkd REST port, which is by default encrypted using SSL. Unless you went out of your way to specifically disable Splunk's SSL support, it should be encrypted already.

That said, the default out-of-the-box Splunk setup either generates a self-signed certificate or uses one provided with Splunk. Either way, it's not the most robust from an SSL point of view. You can (and should) generate your own key and CSR and get a new certificate issues for production installs. (It doesn't have to be a "commercial" CA - you can use an internal CA for the purpose. The point is to not just use the default certificate. )

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...