Splunk Enterprise Security

How can I verify (using splunk internal logs) that port 8089 is indeed with SSL and the TLS version used?

d_lim
Path Finder

My question is, how can I prove that the Splunk server.conf enableSplunkdSSL is indeed working and with the sslVersions is as per my settings, preferably with splunk internal logs SPL showing that?

 

Labels (1)
Tags (3)
0 Karma
1 Solution

d_lim
Path Finder

I found the internal logs to confirm which version of SSL is being used.

For web.conf - index=_internal component=UiHttpListener host=<host you want to verify>

For server.conf - index=_internal component=loader host=<host you want to verify>

View solution in original post

d_lim
Path Finder

I found the internal logs to confirm which version of SSL is being used.

For web.conf - index=_internal component=UiHttpListener host=<host you want to verify>

For server.conf - index=_internal component=loader host=<host you want to verify>

isoutamo
SplunkTrust
SplunkTrust

Hi
you can try this:

index=_internal component=loader "Server supporting SSL"

r. Ismo 

d_lim
Path Finder

I've managed to find that logs, however the question is, it isn't clear that if those are from the web.conf or the server.conf config? Or is it that web.conf enableSplunkWebSSL wont have internal logs?

0 Karma

isoutamo
SplunkTrust
SplunkTrust
If you are using SSL on port 8000, then you see https:// instead of http on query
index=_internal source=*web_access.log https
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...