WTI OOB Secure Syslog (TLS) Configuration Guide for Splunk Enterprise

WTI Knowledge Base • Security • Syslog

WTI OOB Secure Syslog (TLS) Configuration Guide for Splunk Enterprise

Configure a WTI out-of-band (OOB) or IoT device to send encrypted syslog messages to a self-managed Splunk Enterprise server over TCP port 6514 using a self-signed certificate.

TCP 6514 TLS encryption Server verification WTI Web GUI
Scope

This procedure is intended for self-managed Splunk Enterprise on Linux. Splunk Cloud deployments use a different ingestion architecture and are not covered by this guide.

Objective

This configuration uses one-way TLS. Splunk presents its server certificate to the WTI device, and the WTI device verifies that certificate before transmitting syslog data. Splunk does not require a client identity certificate because requireClientCert is set to false.

WTI OOB Device Syslog client
TLS over TCP 6514 Encrypted transport
Splunk Enterprise Secure TCP input

Example Environment

Setting Example value
Splunk server IP 192.168.168.168
Splunk DNS name splunk.yourdomain.com
Secure syslog port 6514/TCP
Splunk index main
Sourcetype syslog

Before you begin

  • Confirm you have sudo or root access to the Splunk Enterprise server.
  • Confirm the WTI device can resolve and reach the Splunk server.
  • Use the same DNS name on the WTI device that appears in the certificate.
  • If you connect by IP address, include that address in the certificate's IP Subject Alternative Name (SAN).
  • Adjust example paths, names, certificate lifetime, index, and sourcetype to match your organization's standards.

Generate a Splunk Syslog TLS Server Certificate

1Create Certificate Directory on Splunk

On the Splunk Enterprise server, create a dedicated directory for the secure syslog certificate files:

sudo mkdir -p /opt/splunk/etc/auth/syslog_tls

2Generate Self-Signed Certificate

Replace the example DNS name and IP address with values from your environment. The SAN entries must match the name or address the WTI device will use to connect.

sudo openssl req -x509 -nodes -newkey rsa:4096 -sha256 -days 3650 \
  -keyout /opt/splunk/etc/auth/syslog_tls/splunk_syslog.key \
  -out /opt/splunk/etc/auth/syslog_tls/splunk_syslog.crt \
  -subj "/C=US/ST=California/L=Irvine/O=WTI/OU=IT/CN=splunk.yourdomain.com" \
  -addext "subjectAltName=DNS:splunk.yourdomain.com,IP:192.168.168.168" \
  -addext "keyUsage=digitalSignature,keyEncipherment" \
  -addext "extendedKeyUsage=serverAuth"
Certificate naming requirement

If the WTI Syslog Address is splunk.yourdomain.com, the certificate must contain that DNS name. If the WTI Syslog Address is 192.168.168.168, the certificate must contain that IP address as an IP SAN.

3Create Combined PEM File for Splunk

Splunk uses a PEM file containing the server certificate followed by its matching private key:

sudo sh -c 'cat /opt/splunk/etc/auth/syslog_tls/splunk_syslog.crt /opt/splunk/etc/auth/syslog_tls/splunk_syslog.key > /opt/splunk/etc/auth/syslog_tls/splunk_syslog.pem'

sudo chmod 600 /opt/splunk/etc/auth/syslog_tls/splunk_syslog.key
sudo chmod 600 /opt/splunk/etc/auth/syslog_tls/splunk_syslog.pem
sudo chmod 644 /opt/splunk/etc/auth/syslog_tls/splunk_syslog.crt

If Splunk runs as the splunk service account, make that account the owner. If your installation uses a different service account, replace splunk:splunk accordingly:

sudo chown -R splunk:splunk /opt/splunk/etc/auth/syslog_tls

Verify that the combined file contains both objects:

sudo grep "BEGIN" /opt/splunk/etc/auth/syslog_tls/splunk_syslog.pem

Expected output:

-----BEGIN CERTIFICATE-----
-----BEGIN PRIVATE KEY-----

4Splunk Syslog TLS Certificate Files

File Purpose Handling
splunk_syslog.crt Public Splunk syslog server certificate Copy this certificate to the WTI device
splunk_syslog.key Private key for the Splunk server Keep secure on the Splunk server only
splunk_syslog.pem Combined certificate and private key used by Splunk Restrict access to the Splunk service account

5Configure Splunk TCP/SSL Syslog Input

Edit the local Splunk input configuration:

sudo nano /opt/splunk/etc/system/local/inputs.conf

Add the following stanzas:

[tcp-ssl:6514]
disabled = 0
index = main
sourcetype = syslog

[SSL]
serverCert = /opt/splunk/etc/auth/syslog_tls/splunk_syslog.pem
requireClientCert = false

If inputs.conf already contains an [SSL] stanza, add or update these settings in the existing stanza instead of creating a duplicate.

One-way TLS

requireClientCert = false enables encrypted transport and server certificate verification without requiring the WTI device to present its own identity certificate.

6Restart Splunk 

sudo /opt/splunk/bin/splunk restart

If your deployment runs Splunk as root:

sudo /opt/splunk/bin/splunk restart --run-as-root

7Verify Splunk Is Listening on Port 6514 

sudo ss -ltnp | grep 6514

Example output:

LISTEN 0 128 0.0.0.0:6514

8Allow TCP 6514 Through Linux Firewall

If UFW is enabled, allow the secure syslog port:

sudo ufw allow 6514/tcp
sudo ufw reload
sudo ufw status numbered
Firewall policy

Where possible, restrict TCP 6514 to the WTI device or approved management subnets instead of allowing unrestricted access. Use the firewall tooling and change process required by your organization.

9Test Network Connectivity from Client

From Windows PowerShell, test the DNS name used in the certificate:

Test-NetConnection splunk.yourdomain.com -Port 6514

Expected result:

TcpTestSucceeded : True

If the certificate includes the server IP as an IP SAN, you can also test by IP:

Test-NetConnection 192.168.168.168 -Port 6514

10Test TLS Handshake

From a Windows or Linux system with OpenSSL installed:

openssl s_client -connect splunk.yourdomain.com:6514 \
  -servername splunk.yourdomain.com -showcerts
Expected result for a self-signed certificate

Verify return code: 18 (self-signed certificate) is expected when the testing workstation does not already trust the certificate. The TLS listener is working if the handshake completes and the Splunk certificate is displayed.

11Export Certificate for WTI OOB Device

Copy the public certificate to a temporary location that your Splunk administrator can securely download. Replace username with the correct Linux account:

sudo cp /opt/splunk/etc/auth/syslog_tls/splunk_syslog.crt /home/username/
sudo chown username:username /home/username/splunk_syslog.crt

Download this public certificate to your workstation:

/home/username/splunk_syslog.crt
Never export or share the private key

The following file must remain protected on the Splunk server:

/opt/splunk/etc/auth/syslog_tls/splunk_syslog.key

12Configure WTI OOB Device

Log in to the WTI device Web GUI and navigate to:

Configuration Network Configuration IPv4 eth0 Syslog Client

Configure the following values:

WTI field Value
Syslog Address splunk.yourdomain.com (recommended), or an IP address included in the certificate's IP SAN
Port 6514
Transport TCP
Secure Syslog (SSL/TLS) On
Secure Syslog Verify Server On
Client Certificate Paste the complete contents of splunk_syslog.crt, including the BEGIN CERTIFICATE and END CERTIFICATE lines
WTI Syslog Parameters IPv4 configuration screen with TCP port 6514 and secure syslog enabled
Example WTI Syslog Parameters IPv4 configuration.
About the Client Certificate field

For this one-way TLS setup, paste only the public Splunk server certificate into this field. Do not paste the private key or the combined PEM file.

  1. Click Change Syslog Client Parameter to save and apply the configuration.
  2. Send a test syslog message from the WTI device.

13Verify Logs in Splunk

In Splunk Search, run:

index=main sourcetype=syslog earliest=-15m
Splunk search results showing WTI syslog events received over TCP port 6514
Example WTI syslog events received by Splunk over TCP port 6514.
Configuration complete

If the search returns events from the WTI device, secure syslog over TLS is operating successfully.

Troubleshooting

Symptom What to check
Splunk is not listening on TCP 6514 Review inputs.conf, the PEM path, file permissions, and Splunk service logs. Then restart or reload the affected input.
TcpTestSucceeded : False Check routing, DNS, host firewall rules, upstream firewalls, and whether Splunk is bound to the expected interface.
Certificate verification fails Confirm the WTI Syslog Address matches a DNS or IP SAN in the certificate and that the complete public certificate was pasted into the WTI device.
TLS connects but no events appear Send a new test event, expand the Splunk time range, verify the index and sourcetype, and search index=* earliest=-15m.
Certificate has expired Generate a replacement certificate, update the Splunk PEM file, paste the new public certificate into the WTI device, and restart or reload the input.

Display the certificate dates, subject, and SAN values:

openssl x509 \
  -in /opt/splunk/etc/auth/syslog_tls/splunk_syslog.crt \
  -noout -dates -subject -ext subjectAltName

Final checklist

  • Splunk has a server certificate whose SAN matches the WTI Syslog Address.
  • The Splunk PEM contains the public certificate and matching private key.
  • [tcp-ssl:6514] is enabled in inputs.conf.
  • TCP 6514 is listening and permitted through required firewalls.
  • Secure Syslog and Verify Server are enabled on the WTI device.
  • Only the public splunk_syslog.crt certificate was copied to the WTI device.
  • WTI events appear in the intended Splunk index and sourcetype.

Published on

Tags: