topic Re: Splunk App for Exchange: DNSLB shows as N/A in Getting Data In

Splunk App for Exchange: DNSLB shows as N/A

clymbouris — Tue, 26 Jun 2012 05:39:59 GMT

I have the app working great. I'm a bit confused on what DNSLB needs to get out. We're using a proxy to access the internet so I set the proxy settings for the domain user running splunk services (I just run IE as the splunk user and set proxy settings). This doesn't seem to work. I can't see any traffic going out from the fw either.

So basically I was wondering:
- Is there any other place where I have to set the proxy settings for this to work?
- Can I have the IPs for the Cisco servers so I can monitor the traffic going out?

Many thanks
Costas

Re: Splunk App for Exchange: DNSLB shows as N/A

ahall_splunk — Mon, 28 Sep 2020 11:59:25 GMT

The TA-SMTP-Reputation uses DNS to check the reputation, not HTTP. Your local DNS server must be able to resolve the DNS queries we are doing - there is no proxy involved.

Make sure your TA-SMTP-Reputation is up to date, that it is installed in $SPLUNK_HOME/etc/apps and that it is producing data. You can run check_my_reputation.py manually using:

splunk cmd python check_my_reputation.py

and ensure it outputs reasonable data. One all that is done, you should be set.