Configure the Data Stream Processor to send data to a self-signed Splunk instance

The Splunk Data Stream Processor supports one-way SSL/TLS with the Splunk HEC endpoints. Use these settings if your Splunk HEC endpoints are secured via HTTPS (SSL/TLS). These settings apply globally to both Send to a Splunk Index (Default for Environment) and Send to a Splunk Index functions. Currently, there is no support for configuring these settings outside of setting or updating environment variables before you deploy your Kubernetes pods, and you cannot change these settings on a per-connection or per-function basis.

We currently have an "all-or-nothing" approach to sending data from DSP to an SSL-enabled Splunk Enterprise instance. This means that you must have all or none of your Splunk Enterprise HEC endpoints configured to use SSL. If the K8S_PIPELINES_DATA_SPLUNKD_SSL_VALIDATION_ENABLED setting is set to true, then all DSP HEC client functions use HTTPS and require a valid certificate from the server.

Enable server certificate validation and hostname validation

1. Enable hostname verification. The DSP HEC client performs a server identity check to confirm that the client is connecting to the correct server and has not been redirected by a man-in-the-middle (MITM) attack. Defaults to false.

   ./set-config K8S_PIPELINES_DATA_SSL_HOSTNAME_VERIFICATION true
   

2. (Optional) If you are using the Splunk Cloud Platform, contact Splunk Support for a Splunk Cloud DigiCert CA.
3. (Optional) After receiving a Splunk Cloud DigiCert CA from Splunk Support or if you are using a CA cert that is not part of the Java JRE default trust store, set the following configuration value in your node.

   ./set-config K8S_PIPELINES_DATA_SPLUNKD_SSL_CERT_BASE64 [base64-encoded-CA] 

4. Enable SSL validation. When enabled, the Send to a Splunk Index (Default for Environment) and Send to a Splunk Index functions connect to the Splunk Enterprise HEC endpoints via HTTPS and validate the server's SSL certificate. Defaults to true. Set this to true if the CA certificate you used to sign your Splunk server certificates is part of the Java JRE default trust store.

   ./set-config K8S_PIPELINES_DATA_SPLUNKD_SSL_VALIDATION_ENABLED true
   

5. After setting the configurations, deploy your changes.

   ./deploy
   

6. Restart all pipelines using the Send to a Splunk Index (Default for Environment) and Send to a Splunk Index functions for your changes to take effect.

Disable server certificate validation and hostname validation

1. Disable hostname verification.

   ./set-config K8S_PIPELINES_DATA_SSL_HOSTNAME_VERIFICATION false
   

2. Disable SSL validation. If true, the Send to a Splunk Index (Default for Environment) and Send to a Splunk Index functions connect to the Splunk Enterprise HEC endpoints via HTTPS and validate the server's SSL certificate. If false, the Send to a Splunk Index (Default for Environment) and Send to a Splunk Index functions still use HTTPS but do not validate the server's SSL certificate. Defaults to true.

   ./set-config K8S_PIPELINES_DATA_SPLUNKD_SSL_VALIDATION_ENABLED false
   

3. After setting the configurations, deploy your changes.

   ./deploy
   

4. Restart all pipelines using the Send to a Splunk Index (Default for Environment) and Send to a Splunk Index functions for your changes to take effect.