Splunk Enterprise

TLS between splunk components

Nawab
Path Finder

We have below deployement, UF ----> HF ----> IDX

Uf are sending data to Hf and Hf is acting as and Intermediatry forwarder between UF and IDX.

Now we want to do TLS b/w splunk components. can we do TLS between HF and IDX and leave UFs.

Will UF data will also be TLS complient?

If not will UF still sends data to IDXs or we will stop receiving logs all together?

Labels (1)
0 Karma

Nawab
Path Finder

Thanks for your answer, let me do it and check if it works.

 

Also why are you doing ssl on inputs.conf as per docs it should be done on outsputs of HF

0 Karma

isoutamo
SplunkTrust
SplunkTrust
Here is conf presentation about using TLS with splunk https://conf.splunk.com/files/2023/slides/SEC1936B.pdf
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Nawab- The answer is yes, you can setup SSL on both places and you can also set SSL only for HF to Indexer.

I think it should not matter what you use from UF to HF and HF to Indexer, they should act independent from each other.

 

Connection with SSL

 

inputs.conf
---------------
[splunktcp-ssl:9997]
serverCert = <string>
sslPassword = <string>
requireClientCert = <boolean>
sslVersions = <string>
cipherSuite = <cipher suite string>
ecdhCurves = <comma separated list of ec curves>
dhFile = <string>
allowSslRenegotiation = <boolean>
sslQuietShutdown = <boolean>
sslCommonNameToCheck = <commonName1>, <commonName2>, ...
sslAltNameToCheck = <alternateName1>, <alternateName2>, ...
useSSLCompression = <boolean>


outputs.conf
------------------
[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = <indexer>:9997
sslPassword = password
clientCert = $SPLUNK_HOME/etc/auth/server.pem
(<Check outputs.conf.spec for other SSL configs)

 

 

Connection without SSL

 

inputs.conf
---------------
[splunktcp:9997]


outputs.conf
------------------
[tcpout]
defaultGroup = my_indexers

[tcpout:my_indexers]
server = <indexer>:9997

 

 

I hope this helps!!!!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...