This message originated from Cribl Community Slack.
Click here to view the original link.
In general... should I need to import the default Cribl certificate when attempting to connect one of our AWS EC2 Linux-based Splunk Heavy Forwarders to a Splunk TCP Source hosted in a Cribl Cloud's AWS workgroup? We've confirmed that we have connectivity using netcat, but when I configure the TA in question to send data to the Cribl workgroup (using the FQDN in outputs.conf), the IP addresses fail after 3 attempts and are quarantined.
I've reviewed the splunkd logs on the heavy forwarder, but they have yielded little so far.
Solved
Splunk Heavy Forwarder Fails To Connect To Cribl Cloud: IP Addresses Quarantined After 3 Attempts
Best answer by Jon Rust
Apologies, i thought you were asking about Splunk Fwd -> Splunk Cloud.
Yes, you'll need to get the certs from Splunk Cloud if you plan on using S2S. I'd strongly encourage you use HEC though.
https://docs.cribl.io/stream/securing-import-certs/
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.