All Apps and Add-ons

Integrate CA UIM with Splunk

Eshwar
Engager

Hi Splunk Experts,

We are trying to integrate CA UIM with Splunk to send Splunk alerts to CA UIM. So, we had installed Nimbus (CA UIM) add-on and configured Alert to trigger events and also we had installed nimbus agent on the Splunk enterprise server where is was deployed on Linux x64 as per the instructions but no alerts are triggering for search even if the condition match.  but when we are checking manually we can see many triggered alerts under trigger section. So, can any one suggest what could be the issue and suggest me to resolve it.

Below is the search and alert configuration.

Eshwar_0-1704953853606.png

Eshwar_2-1704953975706.png

Eshwar_4-1704954040182.png

 

Thank you in advance.

Regards,

Eshwar

 

 

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust
2. Ensure 'nimalert' is stored under /opt/nimbus/bin/nimalarm, if not, you can change the path in TA-nimbusalerting/bin/nimbus.sh. 

 The add-on is written by some private person (there is a gmail address on the Contact tab in Splunkbase) and is not very popular so it's hard to tell without deeper debugging what's going on.

I'd start by looking into _internal for any logs containing "nimbus".

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...