topic Re: s4cs Fallback error in Getting Data In

s4cs Fallback error

Bedrohungsjäger — Wed, 18 Jun 2025 17:04:00 GMT

Hey Folkes

Ingesting ZPA logs in Splunk using the Zscaler LSS service, I believe the configuration is correct based on the documentation, however the sourcetype is coming up as sc4s fallback and the logs are unreadable.

It's confirmed that the logs are streaming to the HF.

Can anyone who've done a similar configuration setup advise?

Re: s4cs Fallback error

Bedrohungsjäger — Wed, 18 Jun 2025 17:05:28 GMT

SC4S and not S4cs, apologies for the typo.

Re: s4cs Fallback error

livehybrid — Wed, 18 Jun 2025 17:33:47 GMT

Hi @Bedrohungsjäger

Please can I check what port configuration you have in SC4S? Have you set your port with SC4S_LISTEN_ZSCALER_LSS_TCP_PORT ? (For more info on setup please see https://splunk.github.io/splunk-connect-for-syslog/1.90.1/sources/Zscaler/ but you may have already seen this!

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing