Splunk Enterprise

Does Splunk use TLS/SSL in communication between components?

Haleb
Path Finder

Could you please confirm whether Splunk utilizes TLS/SSL for the following communications by default or it should be manually configured:

  1. Between Search Heads and Indexers
  2. Between Indexers (Index Clustering)
Labels (2)
Tags (3)
0 Karma
1 Solution

deepakc
Builder

By Default when you install Splunk it installs default certs that can be used, but these should be changed as per your organisations TLS cert process alongside the TLS requirements as per the Splunk docs. The default ones are only used for testing, POC etc. 

If you look at the table from this document link, it shows the various components and TLS cert scenarios for Splunk enterprise and cloud and default status.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/AboutsecuringyourSplunkconfigurationwith... 

So, in your case.

  1. (Between Search Heads and Indexers) You would need to create TLS cert for Web Browser Access, not use the default ones, unless just testing - this will give you config and search data. Note the SH should be connected to the Indexers via the Cluster Manager.
  2. Between Indexers (Index Clustering) - If you configure indexers in a cluster, they should also use TLS certificate - this will be for replication data, again its best to create your TLS certs for all the indexers.

Side note: You typically also use the UF's with the indexers certs for UF to Indexer TLS data encryption.

Here's a good link for Splunk TLS certs process and understanding

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_... 

View solution in original post

deepakc
Builder

By Default when you install Splunk it installs default certs that can be used, but these should be changed as per your organisations TLS cert process alongside the TLS requirements as per the Splunk docs. The default ones are only used for testing, POC etc. 

If you look at the table from this document link, it shows the various components and TLS cert scenarios for Splunk enterprise and cloud and default status.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/AboutsecuringyourSplunkconfigurationwith... 

So, in your case.

  1. (Between Search Heads and Indexers) You would need to create TLS cert for Web Browser Access, not use the default ones, unless just testing - this will give you config and search data. Note the SH should be connected to the Indexers via the Cluster Manager.
  2. Between Indexers (Index Clustering) - If you configure indexers in a cluster, they should also use TLS certificate - this will be for replication data, again its best to create your TLS certs for all the indexers.

Side note: You typically also use the UF's with the indexers certs for UF to Indexer TLS data encryption.

Here's a good link for Splunk TLS certs process and understanding

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_... 

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...