rsyslog ssl to indexer

[warmup031]

Hello,

I'm trying to send rsyslog logs via ssl to indexer (splunk version 8), the logs are received by the indexer but not readable (which is my problem, logs are not decrypted).

I've configured the input.conf like this :

tcp-ssl://8514]
Sourcetype = syslog
disabled = false
index = linux
[SSL]
password =
#requireClientCert = false
rootCA = $SPLUNK_HOME/etc/auth/xxx.ca-bundle
serverCert = $SPLUNK_HOME/etc/auth/xxx.crt

netstat show the tcp/8514 opened for splunkd on indexer

and btool

/opt/splunk/etc/apps/search/local/inputs.conf [tcp://8514]
/opt/splunk/etc/system/default/inputs.conf _rcvbuf = 1572864
/opt/splunk/etc/apps/search/local/inputs.conf connection_host = dns
/opt/splunk/etc/system/local/inputs.conf host = xxxxx.fr
/opt/splunk/etc/apps/search/local/inputs.conf index = linux
/opt/splunk/etc/apps/search/local/inputs.conf sourcetype = syslog

Thank you for your help

[richgalloway]

It's not a good practice to send TCP data directly to an indexer.  See http://www.georgestarcher.com/splunk-success-with-syslog/ for some reasons why.

The preferred approach is to have rsyslog write the events to files, which a Universal Forwarder sends to Splunk.  The connection from UF to indexer can be encrypted.

Even better is to use the Splunk Connect 4 Syslog app.  See https://splunkbase.splunk.com/app/4740/