After installing the app Splunk App for CEF and running through the setup. We have restarted the Splunk SearchHead. We have configured our CEF outputs and verified our query by using the preview window. We enable to output, I can see the logs are being created. However, we do not see any data leaving the SearchHead. I have run tcpdump on the SearchHead and no traffic is seen. We have even turned off IPTables just to be sure that is not blocking it.
We are running on RedHat 6.6.
Any suggestions would be welcomed at this point. We have open a case as well.
I am now able to see the Splunk App for CEF sending data to a syslog-ng server and being saved as a file. However, when I look at the file, I do not see it being saved in cef format.
Just to clarify, you installed the app on your search head, and you use that search head to collect the data? Have you set up proper forwarding to your indexer? And why are you using your search head to collect this data?