NetOps Portal Splunk integration fails when using Self-Signed HTTPS certificates

Products

• Network Observability
• CA Performance Management

Issue/Introduction

Splunk integration configuration appears successful in DX NetOps Portal.

No logging events appear in Portal reports.

Splunk UI shows active logging events.

No errors are visible in Portal logs.

While Splunk integration in Portal is configured using the correct real Splunk server hostname, it will fail to communicate. The HTTPS configuration requires we only use hostnames set as CN or SAN values in the HTTPS certificates involved.

Environment

• DX NetOps Portal (All Releases)
• Splunk Integration
• Splunk using Self-Signed HTTPS Certificates

Cause

The integration fails because the Splunk server hostname used in the configuration does not match the Common Name (CN) or Subject Alternative Name (SAN) in the self-signed certificate. When Splunk uses default self-signed certificates, it often uses the string SplunkServerDefaultCert instead of the actual server FQDN.

Resolution

To resolve this issue, align the Portal configuration with the certificate's expected hostname:

1. Identify the expected hostname:

   • Access the Splunk Web UI.
   • View the HTTPS certificate details in the browser.
   • Note the value for the CN or SAN (typically SplunkServerDefaultCert).

2. Update the Portal hosts file:

   • Log in to the Portal machine as a root or sudo user.
   • Open /etc/hosts in a text editor.
   • Add an entry mapping the Splunk IP address to the CN value identified in step 1.
      

     <Splunk_IP_Address> SplunkServerDefaultCert

3. Update Portal Syslog Configuration:

   • Navigate to Administration -> Monitored Items Management -> Syslog Configuration.
   • Locate the Splunk Server Host Name field.
   • Replace the existing hostname with the CN value (e.g., SplunkServerDefaultCert).
   • Select Save.

4. Verify the UI returns a success message and reports begin populating.

Additional Information

Using CA-signed certificates instead of self-signed certificates allows the use of standard FQDNs for integration.