All Apps and Add-ons

Splunk App for CEF 2.0: Is receiving "Invalid routing group" error expected behavior when using "cefout" command?

shftleft
Engager

Hello,

I've installed the Splunk App for CEF 2.0, configured the field mappings and destination syslog server, and pushed the generated TA to the indexers.

When I run the search though that's generated with |cefout my_routing_group the python script is throwing an error that it's an invalid routing group, which makes sense because the only place that group is defined is in the outputs.conf in the TA that's generated to go to the indexers.

Is this expected behavior? I don't see the data going to the /spool directory on the indexer. But, when I change the output group to 'cefroute' it sends the files to the spool directory on the search head. Any insight is appreciated.

0 Karma

hazekamp
Builder

There shouldn't be any errors being thrown. We do WARN if the command is being asked to run on a server where the routing group isn't present:

        # atleast one routing group should exist
        valid = any(group['name'].endswith('stash_cef_%s' % val) for group in input_groups['entry'])
        if valid:
            # store routing group for easy access
            self.routing = val
        else:
            self.logger.warn("Invalid routing group '%s'", val)

This is expected/benign for the Search Head as this will not have the input/output routing groups installed by virtue of Splunk_TA_cefout. If this error is present on any systems which are expected to be forwarding data, then an investigation as to why the configurations are not present must be conducted.

sameeripro
Path Finder

The generated TA has to be extracted twice then you will get a folder which includes files like app,output.... so once you push this folder to indexer it will start forwarding the logs

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...