All Apps and Add-ons

TcpInputProc - Message rejected

acain
Engager

I have been trying to set up Splunk light to receive CMX data from my Cisco Meraki wireless APs. I am using the Meraki Presence Modular Input that is tagged bellow.

Here is how I have the plug-in configured.
Web Server Port: 80
Web Server Bind Address: (Internal IP)
Client Secret: (My Secret)
Client Validator: (My Validator)
API Version: 2.0
Set sourcetype: Manual
Sourcetype: _JSON

Here is how I have the CMX settings configured in the Meraki Cloud Controller.
URL: (External IP)
Secret: (My Secret)
Validator: (My Validator)
API Version: 2.0

This is the error I receive in in the Meraki dashboard:
Response other than 200

This is the error I have in my Splunkd Log:
-0400 ERROR TcpInputProc - Message rejected. Received unexpected 1195725856 byte message! from src=98.198.253.97:1180. Maximum message allowed: 67108864. (::)

I have turned on listening to port 80, as well as all ports referenced by Meraki as possibly being used for CMX data (this is poorly documented, but should be 4567, 5228-5230)

Any help would be appreciated.
Thanks!

0 Karma

brod_geico
Path Finder

first check from your network and firewall team to make sure splunk ports and firewall rules are enabled for splunk.
some times this error messages point to SSL enable also
on the indexer. Don't forget to add the SSL stanza in the inputs.conf on the indexer side.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Optimize AI at Scale: Must-Attend Observability Sessions at .conf26

conf26   With nearly 70 breakout sessions on the docket, the .conf26 Observability track is designed to help ...

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...