Jamf Protect and Splunk Integration Issues

btluynk — Thu, 18 Jan 2024 12:06:18 GMT

Hi team,

I've completed all the configurations according to the steps provided in the following link for integrating Jamf Protect and Splunk:

https://learn.jamf.com/bundle/jamf-protect-documentation/page/Splunk_Integration.html

Under the "Testing the Event Collector Token" section, when I execute the command as instructed in "Using the values obtained in step 1," I can see the log I sent from my local machine on the Splunk search head. However, logs from other clients, especially JamfPro logs, are not visible. I can confirm that the logs are being captured by using tcpdump on the heavy forwarder, but they are not appearing in search results. What could be the reason for this?

Additionally, where can I check error logs from the CLI to investigate this further?

Thanks

topic Jamf Protect and Splunk Integration Issues in Getting Data In

Jamf Protect and Splunk Integration Issues