Splunk Enterprise Security

How can I verify (using splunk internal logs) that port 8089 is indeed with SSL and the TLS version used?

d_lim
Path Finder

My question is, how can I prove that the Splunk server.conf enableSplunkdSSL is indeed working and with the sslVersions is as per my settings, preferably with splunk internal logs SPL showing that?

 

Labels (1)
Tags (3)
0 Karma
1 Solution

d_lim
Path Finder

I found the internal logs to confirm which version of SSL is being used.

For web.conf - index=_internal component=UiHttpListener host=<host you want to verify>

For server.conf - index=_internal component=loader host=<host you want to verify>

View solution in original post

d_lim
Path Finder

I found the internal logs to confirm which version of SSL is being used.

For web.conf - index=_internal component=UiHttpListener host=<host you want to verify>

For server.conf - index=_internal component=loader host=<host you want to verify>

View solution in original post

soutamo
SplunkTrust
SplunkTrust

Hi
you can try this:

index=_internal component=loader "Server supporting SSL"

r. Ismo 

d_lim
Path Finder

I've managed to find that logs, however the question is, it isn't clear that if those are from the web.conf or the server.conf config? Or is it that web.conf enableSplunkWebSSL wont have internal logs?

0 Karma

soutamo
SplunkTrust
SplunkTrust
If you are using SSL on port 8000, then you see https:// instead of http on query
index=_internal source=*web_access.log https
0 Karma