Validate your configuration
To verify your SSL connections in Splunk Web, try the following command:
index=_internal source=*metrics.log* group=tcpin_connections | dedup hostname | table _time hostname version sourceIp destPort ssl
You can also splunkd.log
to validate and troubleshoot your configuration. Splunkd.log is located on your indexer and forwarder at $SPLUNK_HOME/var/log/splunk/splunkd.log
.
On the indexer, look for the following or similar messages at the start-up sequence to verify a successful connection:
02-06-2011 19:19:01.552 INFO TcpInputProc - using queueSize 1000 02-06-2011 19:19:01.552 INFO TcpInputProc - SSL cipherSuite=ALL:!aNULL:!eNULL:!LOW:!EXP: RC4+RSA:+HIGH:+MEDIUM 02-06-2011 19:19:01.552 INFO TcpInputProc - supporting SSL v2/v3 02-06-2011 19:19:01.555 INFO TcpInputProc - port 9997 is reserved for splunk 2 splunk (SSL) 02-06-2011 19:19:01.555 INFO TcpInputProc - Port 9997 is compressed 02-06-2011 19:19:01.556 INFO TcpInputProc - Registering metrics callback for: tcpin_connections
On the forwarder, look for the following or similar messages at the start-up sequence to verify a successful connection:
TcpOutputProc - Retrieving configuration from properties TcpOutputProc - Using SSL for server 10.1.12.112:9997, clientCert=/opt/splunk/etc/auth/server.pem TcpOutputProc - ALL Connections will use SSL with sslCipher= TcpOutputProc - initializing single connection with retry strategy for 10.1.12.112:9997
Below is how a successful connection might appear in splunkd.log on the indexer:
TcpInputProc - Connection in cooked mode from 10.1.12.111 TcpInputProc - Valid signature found TcpInputProc - Connection accepted from 10.1.12.111
Below is how a successful connection might appear in splunkd.log on the forwarder:
TcpOutputProc - attempting to connect to 10.1.12.112:9997... TcpOutputProc - Connected to 10.1.12.112:9997
You can also check metrics.log for something similar to the following:
index=_internal host=heavy hostname=universal | stats last(connectionType) as connectionType
For help troubleshooting your configuration issues, see Troubleshoot your forwarder to indexer configuration in this manual.
Configure Splunk forwarding to use your own SSL certificates | Troubleshoot your forwarder to indexer authentication |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12
Feedback submitted, thanks!