Configure Splunk Edge Hub OS to use HEC over HTTPS for Splunk Enterprise

If your Splunk Enterprise instance has the HTTP Event Collector (HEC) enabled over SSL, you need to upload the TLS certificate that is applied to the HEC endpoint in order for Splunk Edge Hub OS to successfully post data to the HEC.

Prerequisites

• Set up your Splunk Enterprise platform instance to use TLS communication for HEC. See Steps for securing your Splunk Enterprise deployment with TLS to learn how.
• Have a valid certificate to communicate with the secured HEC endpoint. You can use your own or a third-party certificate.
  • For guidance on how to use your own certificate, see How to create and sign your own TLS certificates.
  • To acquire a third-party certificate, see How to obtain certificates from a third-party for Splunk Web.
• Configure the HEC input stanza in inputs.conf as follows:
  

[http]
serverCert = <path to SSL Certificate>
sslPassword = <Certificate Password>

See inputs.conf in the Splunk Enterprise Admin Manual for more details about the inputs.conf file.

• Complete the steps at Access the advanced configuration settings.

Steps

Complete the following steps to configure Splunk Edge Hub OS to use HEC over HTTPS for Splunk Enterprise:

1. In the Edge Hub Advanced Settings page, navigate to the Admin tab.
2. Select Upload CA Certificate.
3. Select the certificate used to communicate with the HEC endpoint.
4. Select Upload.

Verify connectivity

After uploading the certificate, you can verify connectivity by following these steps:

1. In the Edge Hub Advanced Settings page, navigate to the Network tab.
2. Select Connectivity Test.
3. Expand the Check Splunk Services section.
4. Select Start to begin connectivity tests. The tests check if the HEC endpoint is reachable.

The test outputs Reachable or Unreachable for the hostname of your Splunk platform instance and the Spacebridge connection. Both connections are necessary to use HEC over HTTPS for Splunk Enterprise.

If either service is unreachable, contact your partner to troubleshoot. See Customer support escalation in the About the Splunk Edge Hub partner program topic to learn more.