Splunk Enterprise

Does Spunk use TLS/SSL in communication between components?

Haleb
Path Finder

Could you please confirm whether Splunk utilizes TLS/SSL for the following communications by default or it should be manually configured:

  1. Between Search Heads and Indexers
  2. Between Indexers (Index Clustering)
Labels (2)
Tags (3)
0 Karma
1 Solution

deepakc
Builder

By Default when you install Splunk it installs default certs that can be used, but these should be changed as per your organisations TLS cert process alongside the TLS requirements as per the Splunk docs. The default ones are only used for testing, POC etc. 

If you look at the table from this document link, it shows the various components and TLS cert scenarios for Splunk enterprise and cloud and default status.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/AboutsecuringyourSplunkconfigurationwith... 

So, in your case.

  1. (Between Search Heads and Indexers) You would need to create TLS cert for Web Browser Access, not use the default ones, unless just testing - this will give you config and search data. Note the SH should be connected to the Indexers via the Cluster Manager.
  2. Between Indexers (Index Clustering) - If you configure indexers in a cluster, they should also use TLS certificate - this will be for replication data, again its best to create your TLS certs for all the indexers.

Side note: You typically also use the UF's with the indexers certs for UF to Indexer TLS data encryption.

Here's a good link for Splunk TLS certs process and understanding

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_... 

View solution in original post

deepakc
Builder

By Default when you install Splunk it installs default certs that can be used, but these should be changed as per your organisations TLS cert process alongside the TLS requirements as per the Splunk docs. The default ones are only used for testing, POC etc. 

If you look at the table from this document link, it shows the various components and TLS cert scenarios for Splunk enterprise and cloud and default status.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/AboutsecuringyourSplunkconfigurationwith... 

So, in your case.

  1. (Between Search Heads and Indexers) You would need to create TLS cert for Web Browser Access, not use the default ones, unless just testing - this will give you config and search data. Note the SH should be connected to the Indexers via the Cluster Manager.
  2. Between Indexers (Index Clustering) - If you configure indexers in a cluster, they should also use TLS certificate - this will be for replication data, again its best to create your TLS certs for all the indexers.

Side note: You typically also use the UF's with the indexers certs for UF to Indexer TLS data encryption.

Here's a good link for Splunk TLS certs process and understanding

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_... 

Get Updates on the Splunk Community!

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...