Security
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
Solved! Jump to solution

Indexers are NOT configured for SSL input

x1045866
Explorer
‎05-20-2019 12:58 AM

Indexers are NOT configured for SSL input.
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997

Tags (1)
0 Karma
Reply
1 Solution
Solved! Jump to solution
Solution

DavidHourani
Super Champion
‎05-20-2019 05:46 AM

HI @x1045866,

For configuring SSL inputs in Splunk please refer to the official documents as it provides a step by step walkthrough to achieving that.

You can find that over here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/AboutsecuringyourSplunkconfigurationwith...

and here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/ConfigureSplunkforwardingtousesignedcert...

If you're still stuck after that let me know !

Cheers,
David

View solution in original post

0 Karma
Reply
Solved! Jump to solution
Solution

DavidHourani
Super Champion
‎05-20-2019 05:46 AM

HI @x1045866,

For configuring SSL inputs in Splunk please refer to the official documents as it provides a step by step walkthrough to achieving that.

You can find that over here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/AboutsecuringyourSplunkconfigurationwith...

and here :
https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/ConfigureSplunkforwardingtousesignedcert...

If you're still stuck after that let me know !

Cheers,
David

0 Karma
Reply
Solved! Jump to solution

x1045866
Explorer
‎05-20-2019 07:20 AM

Hi David,

Actually this issue reported by client and i am not able to find below events in my environment so please can you provide the SPL command to find the below events.

indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997

0 Karma
Reply
Solved! Jump to solution

x1045866
Explorer
‎05-20-2019 05:50 AM

Thanks for the document and also this issue reported by client and i am not able to find the below SSL not configured error in Search head, Please can you provide the SPL command to fetch the below details.

05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997
05-01-2019 09:15:44.740 -0500 INFO TcpOutputProc - Initializing connection for non-ssl forwarding to indexer_design.com:9997

0 Karma
Reply
Solved! Jump to solution

DavidHourani
Super Champion
‎05-20-2019 10:08 AM

hello @x1045866,

those logs are internal logs and possibly you are not forwarding them to the indexers so you might not be able to see them. You will need to go into the splunkd.log on the host with the following error to see them

0 Karma
Reply
Solved! Jump to solution

x1045866
Explorer
‎05-21-2019 12:41 AM

Hello David,

I am using 12 HF and 29 indexers so where can i install the certificate to configure the SSL for forwarding?

Thanks.

0 Karma
Reply
Solved! Jump to solution

DavidHourani
Super Champion
‎05-20-2019 05:13 AM

what's the question ? 😄

0 Karma
Reply
Solved! Jump to solution

x1045866
Explorer
‎05-20-2019 05:42 AM

How can we configured for SSL input?

0 Karma
Reply
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...