https://community.splunk.com/t5/Getting-Data-In/Check-Point-OPSEC-LEA-configured-but-nothing-return/m-p/50616#M96780 <P>Add a record to /etc/hosts resolved this.</P> <P>/etc/hosts</P> <P>10.10.10.1 centos62-64sup03</P> Thu, 29 Aug 2013 01:58:53 GMT daniel_splunk 2013-08-29T01:58:53Z https://community.splunk.com/t5/Getting-Data-In/Check-Point-OPSEC-LEA-configured-but-nothing-return/m-p/50615#M96779 <P>I've configured the Check Point OPSEC LEA and the connection is fine. State is enabled. When I do a search with sourcetype=opsec, nothing returned.</P> <P>Try to run the following debug script and got the following error message.<BR /> ./splunk cmd $SPLUNK_HOME/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh </P> <H1>Log message:</H1> <PRE><CODE>[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] Could not find info for ...opsec_client... [ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_get_comm: Creating session hash (size=256) [ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_get_comm: ADDING comm=0x85a5f48 to ent=0x85a62a0 with key=2 [ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_env_get_context_id_by_peer_sic_name: found context id=0 for peer sic name=CN=cp_mgmt,O=SENTINEL-ONE_Management_Server..fxugme [ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_env_get_sic_handle_by_context_id: found sic handle (ctx id=0) [ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_sic_connect: connecting... (ctx id=0) [ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] resolver_gethostbyname: Performing gethostbyname for centos62-64sup03 [ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] resolver_gethostbyname: Failed to resolve hostname 'centos62-64sup03' [ 4152015664][28 Aug 18:44:49] fw_ipaddr: Unable to resolve ipaddr for centos62-64sup03 </CODE></PRE> Mon, 28 Sep 2020 14:40:52 GMT https://community.splunk.com/t5/Getting-Data-In/Check-Point-OPSEC-LEA-configured-but-nothing-return/m-p/50615#M96779 daniel_splunk 2020-09-28T14:40:52Z https://community.splunk.com/t5/Getting-Data-In/Check-Point-OPSEC-LEA-configured-but-nothing-return/m-p/50616#M96780 <P>Add a record to /etc/hosts resolved this.</P> <P>/etc/hosts</P> <P>10.10.10.1 centos62-64sup03</P> Thu, 29 Aug 2013 01:58:53 GMT https://community.splunk.com/t5/Getting-Data-In/Check-Point-OPSEC-LEA-configured-but-nothing-return/m-p/50616#M96780 daniel_splunk 2013-08-29T01:58:53Z