All Apps and Add-ons

TcpInputProc - Message rejected

acain
Engager

I have been trying to set up Splunk light to receive CMX data from my Cisco Meraki wireless APs. I am using the Meraki Presence Modular Input that is tagged bellow.

Here is how I have the plug-in configured.
Web Server Port: 80
Web Server Bind Address: (Internal IP)
Client Secret: (My Secret)
Client Validator: (My Validator)
API Version: 2.0
Set sourcetype: Manual
Sourcetype: _JSON

Here is how I have the CMX settings configured in the Meraki Cloud Controller.
URL: (External IP)
Secret: (My Secret)
Validator: (My Validator)
API Version: 2.0

This is the error I receive in in the Meraki dashboard:
Response other than 200

This is the error I have in my Splunkd Log:
-0400 ERROR TcpInputProc - Message rejected. Received unexpected 1195725856 byte message! from src=98.198.253.97:1180. Maximum message allowed: 67108864. (::)

I have turned on listening to port 80, as well as all ports referenced by Meraki as possibly being used for CMX data (this is poorly documented, but should be 4567, 5228-5230)

Any help would be appreciated.
Thanks!

0 Karma

brod_geico
Path Finder

first check from your network and firewall team to make sure splunk ports and firewall rules are enabled for splunk.
some times this error messages point to SSL enable also
on the indexer. Don't forget to add the SSL stanza in the inputs.conf on the indexer side.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...