Secure forwarded data with certificates.

Path Finder

Dear Members,

We have a peculiar problem, there are 3 regions from which we collect data. Each region data should maintain its own integrity for various purposes.

The indexers, search heads and primary deployment server are in the 4th region. Now we use a secondary deployment server in each region which poll to primary DS, the secondary DSs also act as HF to forward data to the common indexers in the 4th region.

Now the requirement is to secure the forwarded data using different certificates for each location. Server certificate could be same but the client certificates should be unique for each region.

Thanks in advance.

0 Karma

Splunk Employee
Splunk Employee

You can create an app for each region that contains the proper config to use for that outputs.conf

Duane Waddle and George Starcher's talk is a great primer for this topic to help supplement Splunk docs:

Just ensure each zone's HF has the cert they need from the CA that the IDX wants and you should be ok. The idx will simply check the cert the HF has, but the IDX's cert is the one that secure comms.

- MattyMo
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>