Splunk App for CEF not sending data

[john_glasscock]

After installing the app Splunk App for CEF and running through the setup. We have restarted the Splunk SearchHead. We have configured our CEF outputs and verified our query by using the preview window. We enable to output, I can see the logs are being created. However, we do not see any data leaving the SearchHead. I have run tcpdump on the SearchHead and no traffic is seen. We have even turned off IPTables just to be sure that is not blocking it.

We are running on RedHat 6.6.

Any suggestions would be welcomed at this point. We have open a case as well.
Thank you

[sameeripro]

what did you to make it running as i am not receiving the logs from Splunk to Arcsight connector

[john_glasscock]

I am now able to see the Splunk App for CEF sending data to a syslog-ng server and being saved as a file. However, when I look at the file, I do not see it being saved in cef format.

[jcoates_splunk]

what do you see with this search?

index=_internal error | dedup punct

[john_glasscock]

I am not seeing anything that relates to the App for CEF when i go through the _internal errors from the search above.

[jeffland]

Just to clarify, you installed the app on your search head, and you use that search head to collect the data? Have you set up proper forwarding to your indexer? And why are you using your search head to collect this data?

[john_glasscock]

The Splunk App for CEF is installed on a dedicated search, per the instructions, to query the data and then forward the results via CEF to a 3rd party i.e. ArcSight.