Validate your configuration

To verify your SSL connections in Splunk Web, try the following command:

index=_internal source=*metrics.log* group=tcpin_connections | 
dedup hostname | table _time hostname version sourceIp destPort ssl

You can also splunkd.log to validate and troubleshoot your configuration. Splunkd.log is located on your indexer and forwarder at $SPLUNK_HOME/var/log/splunk/splunkd.log.

On the indexer, look for the following or similar messages at the start-up sequence to verify a successful connection:

02-06-2011 19:19:01.552 INFO TcpInputProc - using queueSize 1000
02-06-2011 19:19:01.552 INFO TcpInputProc - SSL cipherSuite=ALL:!aNULL:!eNULL:!LOW:!EXP:
RC4+RSA:+HIGH:+MEDIUM

02-06-2011 19:19:01.552 INFO TcpInputProc - supporting SSL v2/v3

02-06-2011 19:19:01.555 INFO TcpInputProc - port 9997 is reserved for splunk 2 splunk (SSL)

02-06-2011 19:19:01.555 INFO TcpInputProc - Port 9997 is compressed

02-06-2011 19:19:01.556 INFO TcpInputProc - Registering metrics callback for: tcpin_connections

On the forwarder, look for the following or similar messages at the start-up sequence to verify a successful connection:

TcpOutputProc - Retrieving configuration from properties

TcpOutputProc - Using SSL for server 10.1.12.112:9997, clientCert=/opt/splunk/etc/auth/server.pem

TcpOutputProc - ALL Connections will use SSL with sslCipher=

TcpOutputProc - initializing single connection with retry strategy for 10.1.12.112:9997

Below is how a successful connection might appear in splunkd.log on the indexer:

TcpInputProc - Connection in cooked mode from 10.1.12.111

TcpInputProc - Valid signature found

TcpInputProc - Connection accepted from 10.1.12.111

Below is how a successful connection might appear in splunkd.log on the forwarder:

TcpOutputProc - attempting to connect to 10.1.12.112:9997...

TcpOutputProc - Connected to 10.1.12.112:9997

You can also check metrics.log for something similar to the following:

index=_internal host=heavy hostname=universal | stats last(connectionType) as connectionType

For help troubleshooting your configuration issues, see Troubleshoot your forwarder to indexer configuration in this manual.