All Apps and Add-ons

Splunk App for CEF: Issue with sending events from Splunk indexers

splunker969
Communicator

Hi,
We are able to configure Splunk App for CEF and after updating we're able to map fields and output group. Since we're unable to test that events are leaving from Splunk when we tested last week for testing purpose. Since we were trying to send logs now. No logs are leaving from indexers we double checked the firewall rule it is allowing. We see no traffic is being left from Splunk Indexers? Means there might be a problem with Splunk side.

Any Thoughts what would be a problem? Any Help, please?

1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

I suggest working through each of these troubleshooting steps, in order: http://docs.splunk.com/Documentation/CEFapp/2.0.1/DeployCEFapp/Troubleshoot#No_data_is_arriving_at_r...

If you have completed those steps and you still can't find the issue, I suggest opening a Support case.

View solution in original post

rpille_splunk
Splunk Employee
Splunk Employee

I suggest working through each of these troubleshooting steps, in order: http://docs.splunk.com/Documentation/CEFapp/2.0.1/DeployCEFapp/Troubleshoot#No_data_is_arriving_at_r...

If you have completed those steps and you still can't find the issue, I suggest opening a Support case.

splunker969
Communicator

Thanks @ rpille

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...