All Apps and Add-ons

Splunk App for CEF not sending data

Path Finder

After installing the app Splunk App for CEF and running through the setup. We have restarted the Splunk SearchHead. We have configured our CEF outputs and verified our query by using the preview window. We enable to output, I can see the logs are being created. However, we do not see any data leaving the SearchHead. I have run tcpdump on the SearchHead and no traffic is seen. We have even turned off IPTables just to be sure that is not blocking it.

We are running on RedHat 6.6.

Any suggestions would be welcomed at this point. We have open a case as well.
Thank you

Explorer

what did you to make it running as i am not receiving the logs from Splunk to Arcsight connector

0 Karma

Path Finder

I am now able to see the Splunk App for CEF sending data to a syslog-ng server and being saved as a file. However, when I look at the file, I do not see it being saved in cef format.

0 Karma

Splunk Employee
Splunk Employee

what do you see with this search?

index=_internal error | dedup punct
0 Karma

Path Finder

I am not seeing anything that relates to the App for CEF when i go through the _internal errors from the search above.

0 Karma

Champion

Just to clarify, you installed the app on your search head, and you use that search head to collect the data? Have you set up proper forwarding to your indexer? And why are you using your search head to collect this data?

0 Karma

Path Finder

The Splunk App for CEF is installed on a dedicated search, per the instructions, to query the data and then forward the results via CEF to a 3rd party i.e. ArcSight.

0 Karma