Splunk Enterprise forwarders must be configured with Indexer Acknowledgement enabled.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| low | V-221936 | SRG-APP-000516-AU-000340 | SPLK-CL-000175 | SV-221936r961863_rule | 2024-08-27 | 3 |
| Description |
|---|
| To prevent the loss of data during transmission, a handshake acknowledgement between the sender and the recipient may need configured. |
| ℹ️ Check |
|---|
| If the server being reviewed is not a forwarder, this check is N/A. In the Splunk installation folder, check the following file in the $SPLUNK_HOME/etc/system/local folder: outputs.conf Locate the section similar to: [tcpout:group1] useACK=true Note that group1 may be named differently depending on how tcpout was configured. If the useACK=true statement is missing or set to false, this is a finding. |
| ✔️ Fix |
|---|
| If the server is not a forwarder, this check is N/A. In the Splunk installation folder, edit the following file in the $SPLUNK_HOME/etc/system/local folder: outputs.conf Locate the section similar to: [tcpout:group1] Note that group1 may be named differently depending on how tcpout was configured. Add the following line under the group stanza above: useACK=true |