All Apps and Add-ons

TcpInputProc - Message rejected

acain
Engager

I have been trying to set up Splunk light to receive CMX data from my Cisco Meraki wireless APs. I am using the Meraki Presence Modular Input that is tagged bellow.

Here is how I have the plug-in configured.
Web Server Port: 80
Web Server Bind Address: (Internal IP)
Client Secret: (My Secret)
Client Validator: (My Validator)
API Version: 2.0
Set sourcetype: Manual
Sourcetype: _JSON

Here is how I have the CMX settings configured in the Meraki Cloud Controller.
URL: (External IP)
Secret: (My Secret)
Validator: (My Validator)
API Version: 2.0

This is the error I receive in in the Meraki dashboard:
Response other than 200

This is the error I have in my Splunkd Log:
-0400 ERROR TcpInputProc - Message rejected. Received unexpected 1195725856 byte message! from src=98.198.253.97:1180. Maximum message allowed: 67108864. (::)

I have turned on listening to port 80, as well as all ports referenced by Meraki as possibly being used for CMX data (this is poorly documented, but should be 4567, 5228-5230)

Any help would be appreciated.
Thanks!

0 Karma

brod_geico
Path Finder

first check from your network and firewall team to make sure splunk ports and firewall rules are enabled for splunk.
some times this error messages point to SSL enable also
on the indexer. Don't forget to add the SSL stanza in the inputs.conf on the indexer side.

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...