topic Re: Netskope onboarding in Getting Data In

Netskope onboarding

tech_g706 — Fri, 11 Apr 2025 09:40:10 GMT

Hi,

I have a question on Netskope onboarding to Splunk.

I installed to TA-NetSkopeAppForSplunk (4.1.0) on Splunk cloud and configured the API tokens provided by Netskope, and logs are flowing.

However, the same add-on and tokens are configured on Splunk Enterprise (Intermediate Heavy Forwarder), and logs are not arriving. I tried using multiple local Splunk Enterprise instances for testing, and no logs.

Any recommendations on what could be the issue with the Enterprise version while it is working fine on Cloud?

Re: Netskope onboarding

livehybrid — Fri, 11 Apr 2025 16:22:23 GMT

Hi @tech_g706

I think the first thing you need to establish is whether you are able to connect to Netskope from your HF on premise.

Then also check your internal logs to see if there were any errors around the collection of these events.

If it looks like the events are collecting then you need to work out why the data is not sending from that forwarder to your indexers.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Netskope onboarding

tech_g706 — Mon, 14 Apr 2025 12:29:02 GMT

Thanks,

Upon checking the logs, it seems MongoDB is not running on the heavy forwarder, and that would be required.

ta_netskopeappforsplunk_netskope_alerts_v2.log
splunklib.binding.HTTPError: HTTP 503 Service Unavailable -- KV Store initialization failed.

2: splunkd.log:
ERROR KVStoreConfigurationProvider [15442 KVStoreConfigurationThread] - Failed to start mongod on first attempt reason=KVStore service will not start because kvstore process terminated
ERROR KVStoreConfigurationProvider [15442 KVStoreConfigurationThread] - Could not start mongo instance. Initialization failed.
ERROR KVStoreBulletinBoardManager [15442 KVStoreConfigurationThread] - Failed to start KV Store process. See mongod.log and splunkd.log for details.
INFO KVStoreConfigurationProvider [15442 KVStoreConfigurationThread] - Mongod service shutting down