Logs Dropping After Some Time, Cybervision + Splunk Integration

[Anit_Mathew]

Hi Team,

After integrating Cybervision with Splunk, I noticed that some logs (events and alerts) stop being received after some time. Both log sources are connected, and the internal logs show that the script is running without any errors.

If I recreate the inputs, all logs start onboarding again. Could you advise what might be causing this issue and where I should look for more details?

In the pictures I added (pdf) , there are 6 logs available in cybervison, but in splunk side only 4 fetched. 

• Add-on version: 2.1.0

• Cybervision version: 5.2.0

• splunk version : 9.4.2

Thanks

[livehybrid]

Hi @Anit_Mathew 

Im not 100% sure your search against the _internal index would pick up all errors from your input.

Are you able to find the logs that get generated when it executes the input? Either errors or anything else? What do these logs indicate? It might be that some are in the splunkd.log but also could be in their own log file. Once you have these you can look either side of them to work out what the python script is reporting.  

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing