McAfee Add-on Splunk DB connect

[sptrey]

I have an upgraded instance of McAfee ePO 5.10 that is using the McAfee Add-on 2.2 with Splunk DB Connect 3.2. After the upgrade, the standard query that was previously used is now not sending the output as it was previously. Can you tell me if this can be resolved by having the DB connector upgraded to the latest version? And does anyone know if there is an update available to McAfee Add-on for Splunk

[PavelP · Accepted solution]

you can check for new version here: https://splunkbase.splunk.com/app/1819/ , the last version is 2.2.1

If you don't see any output then you have to troubleshoot the message chain: ePO -> DB Connect -> Indexer -> SearchHead