All Apps and Add-ons

TcpInputProc - Message rejected

acain
Engager

I have been trying to set up Splunk light to receive CMX data from my Cisco Meraki wireless APs. I am using the Meraki Presence Modular Input that is tagged bellow.

Here is how I have the plug-in configured.
Web Server Port: 80
Web Server Bind Address: (Internal IP)
Client Secret: (My Secret)
Client Validator: (My Validator)
API Version: 2.0
Set sourcetype: Manual
Sourcetype: _JSON

Here is how I have the CMX settings configured in the Meraki Cloud Controller.
URL: (External IP)
Secret: (My Secret)
Validator: (My Validator)
API Version: 2.0

This is the error I receive in in the Meraki dashboard:
Response other than 200

This is the error I have in my Splunkd Log:
-0400 ERROR TcpInputProc - Message rejected. Received unexpected 1195725856 byte message! from src=98.198.253.97:1180. Maximum message allowed: 67108864. (::)

I have turned on listening to port 80, as well as all ports referenced by Meraki as possibly being used for CMX data (this is poorly documented, but should be 4567, 5228-5230)

Any help would be appreciated.
Thanks!

0 Karma

brod_geico
Path Finder

first check from your network and firewall team to make sure splunk ports and firewall rules are enabled for splunk.
some times this error messages point to SSL enable also
on the indexer. Don't forget to add the SSL stanza in the inputs.conf on the indexer side.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...