So I have a group of servers that I am load balancing across and I am trying to figure out how to set the "sslCommonNameToCheck" variable when handling multiple servers. This does not look like it allows a comma separated list.
I want it to look something like this:
[tcpout] defaultGroup = myIndexers [tcpout:myIndexers] maxQueueSize = 128MB useACK = true autoLB = true server = splunk-idx01.myorg.com:9998, splunk-idx02.myorg.com:9998 sslCertPath = $SPLUNK_HOME/etc/auth/myOrg/splunk-forwarder.pem sslPassword = <REDACTED> sslRootCAPath = $SPLUNK_HOME/etc/auth/myOrg/cacert.crt sslVerifyServerCert = true sslCommonNameToCheck = splunk-idx01.myorg.com, splunk-idx02.myorg.com
But like I said, I do not believe this takes a comma separated value.
I tried something I found in the "bonus/deleted" slides from the 2015 .conf presentation by Defense Point Security on SSL Best Practices:
in which they do the same as above except break out each server with stanzas as follows:
[splunk-idx01.myorg.com] sslVerifyServerCert = true sslCommonNameToCheck = splunk-idx01.myorg.com [splunk-idx02.myorg.com] sslVerifyServerCert = true sslCommonNameToCheck = splunk-idx02.myorg.com
I tried this, and it doesn't work as that is not the right syntax on stanzas. Anyone setup SSL with Load Balancing?
Had read all through it, and I think it was throwing me off since I was afraid that the "tcpout-server://" setting would maybe somehow keep it from load balancing correctly. by instead duplicating all the data equally to the servers. I will give this a go and see if that works.
I am just not sure the best way to validate that it is load balancing and not sending the data out to all of my indexers at the same time (e.g. instead of it logging something once, I would guess to find my data copied 4 times over on my 4 indexers.)