Splunk logging not working from Virtual host

[nikhilchawla]

Hi,

I have 2 environments in which one is set up with virtual host custom domain.I'm logging to splunk with javascript policy inside sharedflow. Same sharedflow is able to send logs to splunk from the environment which is not set up with virtual host. Environment with virtual host is not able to send logs to splunk. I suspected the SSL configuration and to confirm it, i tried with postman and got the SSL error. I disabled SSL certificate validation on Postman and was able to Post to splunk.

I tried same thing in sharedflow Javascript policy :

<DisplayName>JS - Invoke Splunk JS</DisplayName>

<Properties/>

<SSLInfo>

<Enabled>False</Enabled>

</SSLInfo>

But it is still not working.

[bhatikuldeep]

Hi @nikhilchawla,

TBH, I have not tried on Splunk, however successfully tested below snippet on ELK stack, So it should work;

For SSL (and I assume there's two-way SSL in place), so try putting below properties;

<SSLInfo>
            <Enabled>true</Enabled>
            <ClientAuthEnabled>true</ClientAuthEnabled>
            <KeyStore>ref://add-your-keystore-ref</KeyStore>
            <KeyAlias>add-your-key-alias</KeyAlias>
            <TrustStore>ref://add-your-truststore-ref</TrustStore>
        </SSLInfo>

Give it a try and let me know if it works, good luck!

[nikhilchawla]

@Kuldeep Bhati. I tried it but didn't work.

[bhatikuldeep]

It appears, misconfiguration of the virtual hosts; lets take just one step back, did you check if your northbound api endpoint works fine using this virtual host?