Splunk Enterprise forwarders must be configured with Indexer Acknowledgement enabled.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| low | V-221936 | SRG-APP-000516-AU-000340 | SPLK-CL-000175 | SV-221936r961863_rule | 2024-08-27 | 3 |
Description
To prevent the loss of data during transmission, a handshake acknowledgement between the sender and the recipient may need configured.
ℹ️ Check
If the server being reviewed is not a forwarder, this check is N/A.
In the Splunk installation folder, check the following file in the $SPLUNK_HOME/etc/system/local folder:
outputs.conf
Locate the section similar to:
[tcpout:group1]
useACK=true
Note that group1 may be named differently depending on how tcpout was configured.
If the useACK=true statement is missing or set to false, this is a finding.
✔️ Fix
If the server is not a forwarder, this check is N/A.
In the Splunk installation folder, edit the following file in the $SPLUNK_HOME/etc/system/local folder:
outputs.conf
Locate the section similar to:
[tcpout:group1]
Note that group1 may be named differently depending on how tcpout was configured.
Add the following line under the group stanza above:
useACK=true