Is it possible to setup HEC to use multiple/unique ports and ssl certificates for multiple/unique senders?

[Glasses]

Hi
When I create a new input for HTTP Event Collector via the WebUI

Under /opt/splunk/etc/apps/search/local inputs.conf
I see the input stanza:

[http://test_recieve_http_post]
disabled = 0
index = main
indexes = main
sourcetype = test_http_post
token = blah-blah-blah-blah-blah

in /opt/splunk/etc/apps/splunk_httpinput/local

[http]
index = main
port = 6666
sourcetype = test_http_post
disabled = 0
enableSSL = 1
sslPassword = <some_password>
privKeyPath = /opt/splunk/etc/auth/my_certs/hec.key
serverCert = /opt/splunk/etc/auth/my_certs/hec.pem

From the WebUI it appears that you cannot give the HEC multiple ports, as there is only one inputbox for port... but I would like to have multiple ports with there own ssl certs.... like 6666 hec.key, hec.pem, and 6667 hec2.key, hec2, pem.... so that I can provide separate ports and ssl certs to each sender...

Is there a way to override this?

Thank you.

[harsmarvania57 · Accepted solution]

Hi,

You can't configure HEC to listen on multiple port with different SSL certificate. If you want to achieve this then you can configure Load Balancer to receive traffic on different port with different SSL certificate then offload SSL traffic on LB & on upstream send traffic to single HEC port.

[starcher]

And why would you? The senders don't need client certs. Just to trust the root CA of the cert the HEC is using.

[Glasses]

IDK someone with a "good idea" wanted me too... thank you for the comment, I agree with you.