Splunk Add-on for Bit9 Carbon Black: Why is the Carbon Black Event Forwarder utility not getting started?

[sumit29]

Dear Experts ,

I have installed the Splunk Add-on for Bit9 Carbon Black and I have installed the Carbon Black Event Forwarder utility on the Carbon Black Server. Issue is that agent is not getting started. The page mentioned below doesn't give you proper information.

https://github.com/carbonblack/cb-event-forwarder

If anyone has configured this successfully, Kindly help

Thanks in advance ..

[jagjag]

Hi @sumit29, do you have more information that you can share? Is the cb-event-forwarder service not starting, and if so, do you have any entries in the /var/log/cb/integrations/cb-event-forwarder log directory?

If you'd like to talk privately, please contact us at dev-support@bit9.com and I'll summarize the findings here for others.

Thanks!

[jagjag]

I think I have identified your problem, @sumit29. As a temporary workaround, try running the following commands on the host you installed cb-event-forwarder:

yum install -y python-cbfeeds
yum install -y python-cbapi

I will be fixing the problem today. Thank you for your patience. Let me know if that does not fix your problem.

Thanks!