How can I verify (using splunk internal logs) that port 8089 is indeed with SSL and the TLS version used?

[d_lim]

My question is, how can I prove that the Splunk server.conf enableSplunkdSSL is indeed working and with the sslVersions is as per my settings, preferably with splunk internal logs SPL showing that?

[d_lim · Accepted solution]

I found the internal logs to confirm which version of SSL is being used.

For web.conf - index=_internal component=UiHttpListener host=<host you want to verify>

For server.conf - index=_internal component=loader host=<host you want to verify>

[isoutamo]

Hi
you can try this:

index=_internal component=loader "Server supporting SSL"

r. Ismo 

[d_lim]

I've managed to find that logs, however the question is, it isn't clear that if those are from the web.conf or the server.conf config? Or is it that web.conf enableSplunkWebSSL wont have internal logs?

[isoutamo]

If you are using SSL on port 8000, then you see https:// instead of http on query
index=_internal source=*web_access.log https