SPLK-CL-000170 - Splunk Enterprise must use TCP for data transmission.

Information

If the UDP protocol is used for communication, then data packets that do not reach the server are not detected as a data loss. The use of TCP to transport data improves delivery reliability, adds data integrity, and gives the option to encrypt the traffic.

Solution

Select Settings >> Data Inputs, and verify there are zero inputs configured under UDP. Remove any that exist and recreate using TCP.

It is recommended to set these settings before disabling the web UI of the instance in a distributed environment.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Splunk_Enterprise_7-x_for_Windows_V3R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-221614r961863_rule, STIG-ID|SPLK-CL-000170, STIG-Legacy|SV-111325, STIG-Legacy|V-102375, Vuln-ID|V-221614

Plugin: Splunk

Control ID: 337508b5caee7d38ef59ba28f0772a7b6850b687f1df6f3871cbd7b2f853aa57