Hey Happy New Year Splunkers'
We want to forward data from Universal Forwarder --> Heavy Forwarder --> Indexers --> Search Head using SSL b\w HF and Indexers.
We have enabled SSL and we have an error appear "Most likely cause is the scheme or the port number is wrong".
I am not sure that do I have to put stanza of certificate path and port number in config files. And can some tell me what do I need to show up in UF configs and HF configs.
Here are the inputs and outputs config files from HF.
inputs.conf
[default]
host = xxxx
outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout-server://xxx.xx.xx.x:9997]
[tcpout-server://xxx.xx.xx.x:9997]
[tcpout:default-autolb-group]
disabled = false
server = xxx.xx.xx.x,.xxx.xx.xx.x
[tcpout-server://xxx.xx.xx.x:9997]
Please suggest me if I need to change anything in these configs.
Your outputs.conf probably needs to look like this instead:
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = xxx.xx.xx.x:9997,.xxx.xx.xx.x:9997
From the docs, [tcpout-server:]
is for single server configuration, not for multiple like you're trying. And the server
configuration in your [tcpout:<group>]
needs to have :<port>
, as I included in my example.