All Apps and Add-ons

Streaming AWS data to Splunk using Firehose

segevgal87
Loves-to-Learn

Hi,

I'm trying to stream AWS logs using the Kinesis firehose method. I followed a tutorial and verified each step a few times.
I have generated a certificate for my Splunk Enterprise server using Let's Encrypt. My HEC is using that certificate and I know for sure that it is healthy and secure (used the following URL: https://host.domain.net:8088/services/collector/health)

I keep getting the following error on the monitoring of the Kinesis Firehose:

Could not connect to the HEC endpoint. Make sure that the certificate and the host are valid.
Splunk.SSLHandshake

Any ideas about what could go wrong?

Splunk Version ............ 8.0.0

0 Karma
1 Solution

soumyasaha25
Contributor

Hi @segevgal87, although i have not tested it myself, based on the answer on this post it might be due to LetsEncrypt.

Could you try using an AWS ACM cert ? Do you get the same error with ACM certs.

View solution in original post

0 Karma

soumyasaha25
Contributor

Hi @segevgal87, although i have not tested it myself, based on the answer on this post it might be due to LetsEncrypt.

Could you try using an AWS ACM cert ? Do you get the same error with ACM certs.

0 Karma

amiracle
Splunk Employee
Splunk Employee

You need to have a valid certificate on either your Load Balancer (ELB for AWS deployments) or on your machine accepting the data from Firehose. The default HEC SSL Cert is not a valid third party SSL cert and will thus fail. You can either issue one from ACM (AWS Certificate Manager) so you can test your deployment. To make your life easier, you should use an ELB with a valid cert on a HF tier and then forward the data into your Splunk indexers. This link might help with how to set that up.

0 Karma

segevgal87
Loves-to-Learn

Hi,

I purchased a domain so I could try the ELB approach and it worked!
I guess the Let's Encrypt certificate was the issue...

Thanks amiracle and soumyasaha25

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...