Is it Possible to Send Data to Splunk Without SSL Handshake?

[rake]

Hi,

I’m currently setting up a pipeline to send logs from AWS Kinesis Firehose to Splunk. I'm using Splunk’s Cloud Trial version as the destination endpoint, and my goal is to send data without requiring an SSL handshake.

Here's a summary of my setup:

• Service: AWS Kinesis Firehose
• Destination: Splunk Cloud Trail (using Splunk HEC URL)
• Goal: Send data directly from Firehose to Splunk without SSL validation, if possible.

  "errorCode": "Splunk.SSLHandshake",
  "errorMessage": "Could not connect to the HEC endpoint. Make sure that the certificate and the host are valid."

  To troubleshoot, I also tested sending a record with the following command:

  aws firehose put-record --delivery-stream-name FirehoseSplunkDeliveryStream \
  --record='{"Data":"eyJldmVudCI6eyJrZXkxIjoidmFsdWUxIiwia2V5MiI6InZhbHVlMiJ9fQ=="}'

   The SSL handshake error persists when connecting to the Splunk HEC endpoint.

  Has anyone configured a similar setup, or is there a workaround to disable SSL validation for the Splunk endpoint? I'm new to splunk and just trying it out, any insights or suggestions would be greatly appreciated!

  Thanks!

[sainag_splunk · Accepted solution]

 Hello @rake This could be the issue because you are on trial version (firehose has another endpoint) .

Deploying this add-on to free trial Splunk Cloud deployments is not supported at this time.

Refer: https://docs.splunk.com/Documentation/AddOns/released/Firehose/Installationoverview


Note: Disabling SSL validation is not recommended for production environments..

If this helps, please Upvote.