Forwarding of Events preserving raw logs from Splunk Enterprise to RSA Netwitness SIEM

deepak453 — Thu, 02 Aug 2018 14:15:33 GMT

Hi,
Seeking you inputs to achieve the below scenario.

Scenario
Both Splunk and RSA Netwitness is installed in AWS environment, VPCID of both is same and all inbound and outbound traffic is allowed. Have uploaded few csv files of various devices. Requirement is to forward the events + raw logs from Splunk to RSA NW component.

I have configured the forwarding through Splunk GUI, :514. Post configuring this forwarding one outputs.conf file created in splunk local directory. Have added a syntax “sendCookedData=false” in outputs.conf file. Also tried with forwarding port 6996.

But nothing is working and getting error “The TCP output processor has paused the data flow. Forwarding to output group default-autolb-group has been blocked for 3880 seconds. This will probably stall the data flow towards indexing and other network outputs. Review the receiving system's health in the Splunk Monitoring Console. It is probably not accepting data.”

Could any please help me with the configuration part which I missed in splunk end.

Re: Forwarding of Events preserving raw logs from Splunk Enterprise to RSA Netwitness SIEM

deepak453 — Sun, 05 Aug 2018 15:48:54 GMT

@asiddique_splunk seeking your expert inputs on this.

topic Forwarding of Events preserving raw logs from Splunk Enterprise to RSA Netwitness SIEM in Splunk Dev

Forwarding of Events preserving raw logs from Splunk Enterprise to RSA Netwitness SIEM

Re: Forwarding of Events preserving raw logs from Splunk Enterprise to RSA Netwitness SIEM