Why are the logs are not being collected in CB Protection App for Splunk?

[hjf_bsingh]

1. Configured CB Protection application to export logs.
2. Installed CB Protection App on the Splunk Server.
3. Installed CB Protection App on all the Indexers. 
4. Installed UF and CB Protection App on the CB Protection Server 
    a. Configured the App to forward logs. 
    b. Checked logs on CB Protection server in /var/log/splunk/splunkd.log 
08-08-2018 08:11:33.776 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:12:33.744 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:13:03.448 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.

[hjf_bsingh]

I don't know when the new version is coming out but the current version version works with Splunk 7.2.1.

[johnward4]

@carbonblack when is a new version of this app being released that's compatible with Splunk Enterprise 7.x*?

[johnward4]

Does anyone know if this app works with Splunk Enterprise 7.x*?

[hjf_bsingh · Accepted solution]

Figured it out, The Splunk App on the CB Protection server was placed under a folder "cb-protection-app-for-splunk_20", it should been "bit9-secapp".

[hjf_bsingh]

There is no customization of source type or index.