All Apps and Add-ons

TcpInputProc - Message rejected

acain
Engager

I have been trying to set up Splunk light to receive CMX data from my Cisco Meraki wireless APs. I am using the Meraki Presence Modular Input that is tagged bellow.

Here is how I have the plug-in configured.
Web Server Port: 80
Web Server Bind Address: (Internal IP)
Client Secret: (My Secret)
Client Validator: (My Validator)
API Version: 2.0
Set sourcetype: Manual
Sourcetype: _JSON

Here is how I have the CMX settings configured in the Meraki Cloud Controller.
URL: (External IP)
Secret: (My Secret)
Validator: (My Validator)
API Version: 2.0

This is the error I receive in in the Meraki dashboard:
Response other than 200

This is the error I have in my Splunkd Log:
-0400 ERROR TcpInputProc - Message rejected. Received unexpected 1195725856 byte message! from src=98.198.253.97:1180. Maximum message allowed: 67108864. (::)

I have turned on listening to port 80, as well as all ports referenced by Meraki as possibly being used for CMX data (this is poorly documented, but should be 4567, 5228-5230)

Any help would be appreciated.
Thanks!

0 Karma

brod_geico
Path Finder

first check from your network and firewall team to make sure splunk ports and firewall rules are enabled for splunk.
some times this error messages point to SSL enable also
on the indexer. Don't forget to add the SSL stanza in the inputs.conf on the indexer side.

0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...