Integrate CA UIM with Splunk

[Eshwar]

Hi Splunk Experts,

We are trying to integrate CA UIM with Splunk to send Splunk alerts to CA UIM. So, we had installed Nimbus (CA UIM) add-on and configured Alert to trigger events and also we had installed nimbus agent on the Splunk enterprise server where is was deployed on Linux x64 as per the instructions but no alerts are triggering for search even if the condition match.  but when we are checking manually we can see many triggered alerts under trigger section. So, can any one suggest what could be the issue and suggest me to resolve it.

Below is the search and alert configuration.

Thank you in advance.

Regards,

Eshwar

[PickleRick]

2. Ensure 'nimalert' is stored under /opt/nimbus/bin/nimalarm, if not, you can change the path in TA-nimbusalerting/bin/nimbus.sh. 

 The add-on is written by some private person (there is a gmail address on the Contact tab in Splunkbase) and is not very popular so it's hard to tell without deeper debugging what's going on.

I'd start by looking into _internal for any logs containing "nimbus".