Getting Data In

HTTPEventCollector cannot create token due to sslVersion configuration

lyndac
Contributor

I'm trying to create a token in the HttpEventCollector input and I get the error: "A token cannot have individual configuration for sslVersions".

I am required to only allow splunk to use tls1.1 or tls1.2 for ssl. Therefore, I have the settings below. Is there a way a way around this?

inputs.conf:

[default]
sslVersion=tls1.1,tls1.2

server.conf:

[sslConfig]
sslVersion=tls1.1,tls1.2

web.conf:

[settings]
sslVersions=tsl1.1,tls1.2

The token I'm trying to create has these values:

Input Type: Token
Name:  accm
source name override:  N/a
Description:  N/A
Enable indexer acknowledgements:  yes
output group:  N/A
Allowed indexes:  accm_idx
source type:  accm-json

nmadhok
Path Finder

Hello,

Please remove sslVersion=tls1.1,tls1.2 from [default] section of your inputs.conf file and instead put it under [SSL] section of your inputs.conf file followed by a Splunk service restart.

inputs.conf:

[SSL]
sslVersion=tls1.1,tls1.2

The issue exists because when you put sslVersion under [default] stanza of your inputs.conf file, it gets copied into each HTTP Event Collector Token stanza ( http://<INPUT-NAME>; ). This should not be happening and is most likely a bug. When specifying sslVersion under [default] stanza of your inputs.conf, the intended/desired behavior should be the same as when specifying sslVersion under the [http] stanza of your inputs.conf file.

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...