All Apps and Add-ons

Splunk Add-On for Tomcat: Search Head not working

New Member

I deployed the Tomcat Add-On for Splunk. It's currently running on both my indexer and search head.

It's working without issue on the indexer. But it's not displaying the data in the correct format on the search head. And I'm not sure what to do to fix this issue:

I've checked to make sure the data is in the correct format for the forwarder
I've checked the permissions on the server, they're correct
I've recreated my environment to spec...

I've done everything except get the bloody thing to work. I need help.

0 Karma

Splunk Employee
Splunk Employee


This add-on has 3 logs that are located at $SPLUNK_HOME/var/log/splunk:


Have you checked this to figure out what is wrong?


Can you be more precise on data not being in correct format. This will help the community in answering with most relevance.
Have you checked for all the compatibility versions, Splunk, Addon, CIM etc. ?

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...