Security

Is it possible to setup HEC to use multiple/unique ports and ssl certificates for multiple/unique senders?

Glasses
Builder

Hi
When I create a new input for HTTP Event Collector via the WebUI

Under /opt/splunk/etc/apps/search/local inputs.conf
I see the input stanza:

[http://test_recieve_http_post]
disabled = 0
index = main
indexes = main
sourcetype = test_http_post
token = blah-blah-blah-blah-blah

in /opt/splunk/etc/apps/splunk_httpinput/local

[http]
index = main
port = 6666
sourcetype = test_http_post
disabled = 0
enableSSL = 1
sslPassword = <some_password>
privKeyPath = /opt/splunk/etc/auth/my_certs/hec.key
serverCert = /opt/splunk/etc/auth/my_certs/hec.pem

From the WebUI it appears that you cannot give the HEC multiple ports, as there is only one inputbox for port... but I would like to have multiple ports with there own ssl certs.... like 6666 hec.key, hec.pem, and 6667 hec2.key, hec2, pem.... so that I can provide separate ports and ssl certs to each sender...

Is there a way to override this?

Thank you.

0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

View solution in original post

harsmarvania57
SplunkTrust
SplunkTrust

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

starcher
SplunkTrust
SplunkTrust

And why would you? The senders don't need client certs. Just to trust the root CA of the cert the HEC is using.

0 Karma

Glasses
Builder

IDK someone with a "good idea" wanted me too... thank you for the comment, I agree with you.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>