I am running a Splunk Indexer on Docker in an EC2 instance. I use the following Compose file to start the service. However, every time I restart the EC2 instance, the contents of inputs.conf get reset.     version: "3.6" networks: splunknet: driver: bridge attachable: true volumes: splunk-var: external: true splunk-etc: external: true services: splunk: networks: splunknet: aliases: - splunk image: xxxxxx.dkr.ecr.ap-northeast-1.amazonaws.com/splunk/splunk:latest container_name: splunk restart: always environment: - SPLUNK_START_ARGS=--accept-license - SPLUNK_PASSWORD=password ports: - "80:8000" - "9997:9997" volumes: - splunk-var:/opt/splunk/var - splunk-etc:/opt/splunk/etc       The following is my conf.     [splunktcp-ssl:9997] disabled = 0 [SSL] serverCert = /opt/splunk/etc/auth/mycerts/myCombinedServerCertificate.pem sslPassword = password requireClientCert = false           ... View more

I am configuring TLS communication between UF (Universal Forwarder) and Indexer. My outputs.conf configuration is as follows:   [tcpout] defaultGroup = default-autolb-group [tcpout-server://xxxxxxx:9997] [tcpout:default-autolb-group] server = xxxxxxx:9997 disabled = false sslPassword = ServerCertPassword sslRootCAPath = /opt/splunkforwarder/etc/auth/mycerts/myCertAuthCertificate.pem sslVerifyServerCert = false useACK = true sslCertPath = /opt/splunkforwarder/etc/auth/mycerts/myCombinedServerCertificate.pem   I have three questions: 1. I don't need a client certificate right now. If I don't set sslCertPath, an error occurs. Is this option mandatory? 2. Currently, I have set sslCertPath to the server certificate, and TLS communication works. Why do I need to set the server certificate on the client? Is this a common practice? 3. If I want to use a client certificate, which configuration setting should I use? ... View more

1. This is $SPLUNK_HOME/etc/system/local/inputs.conf of my Indexer. [splunktcp-ssl:9997] disabled = 0 [SSL] serverCert = /opt/splunk/etc/auth/mycerts/myCombinedServerCertificate.pem sslPassword = $7$2sKE3fmGeaZOyBdYg6AfpoU1Gv7kXP3pEihEQoWlSKFeItPCn0lNyb0=  (myServerPrivateKeyPassword) requireClientCert = false   2. This is $SPLUNK_HOME/etc/system/local/server.conf of my Indexer. [general] serverName = 4b2c00e08e88 pass4SymmKey = $7$kbQmQuYtD+ees5uv8q+WaE36j8Sk07HcWoVgOMmP8Bb69nbwERriow== [sslConfig] sslPassword = $7$9eO6Wt/mPl2QIOEu/+xh44foXzSDvMRs/0LyNn/EuZ+ab/Q93LB8bg==(Default. I did not modify) sslRootCAPath = /opt/splunk/etc/auth/mycerts/myCertAuthCertificate.pem [lmpool:auto_generated_pool_download-trial] description = auto_generated_pool_download-trial peers = * quota = MAX stack_id = download-trial [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder peers = * quota = MAX stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free peers = * quota = MAX stack_id = free   3. This is /opt/splunkforwarder/etc/system/local/outputs.conf of my UF. [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = 176.32.83.56:9997 disabled = 0 sslPassword = $7$M4MRBHX8rh11KC509o7cRe/QOxo3EZBA5pXjGn5cZuHtb0FO3dFj5ks=(myServerPrivateKeyPassword) sslVerifyServerCert = false   4. This is /opt/splunkforwarder/etc/system/local/server.conf of my UF. [general] serverName = suf pass4SymmKey = $7$hE1rQcMJG9ZPB0DvxG+KMGbMmNly4JylVUhFC59Nz+LBa+o1ahblmg== [sslConfig] sslPassword = $7$30hXe/EpmNqvXRzVPC0KF+1YNptHuhrxEnChvX5Se8ySRni+uAQFHWk=(Default. I did not modify) sslRootCAPath = /opt/splunkforwarder/etc/auth/mycerts/myCertAuthCertificate.pem [lmpool:auto_generated_pool_forwarder] description = auto_generated_pool_forwarder peers = * quota = MAX stack_id = forwarder [lmpool:auto_generated_pool_free] description = auto_generated_pool_free peers = * quota = MAX stack_id = free     The above configurations did not succeed. When I executed the following command: /opt/splunkforwarder/bin/splunk list forward-server   I got the following result. Active forwards: None Configured but inactive forwards: 176.32.83.56:9997   ... View more