All Apps and Add-ons
Highlighted

Why are the logs are not being collected in CB Protection App for Splunk?

Explorer
1. Configured CB Protection application to export logs.
2. Installed CB Protection App on the Splunk Server.
3. Installed CB Protection App on all the Indexers. 
4. Installed UF and CB Protection App on the CB Protection Server 
    a. Configured the App to forward logs. 
    b. Checked logs on CB Protection server in /var/log/splunk/splunkd.log 
08-08-2018 08:11:33.776 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:12:33.744 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:13:03.448 -0400 INFO  TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
0 Karma
Highlighted

Re: Why are the logs are not being collected in CB Protection App for Splunk?

Explorer

There is no customization of source type or index.

0 Karma
Highlighted

Re: Why are the logs are not being collected in CB Protection App for Splunk?

Explorer

Figured it out, The Splunk App on the CB Protection server was placed under a folder "cb-protection-app-for-splunk_20", it should been "bit9-secapp".

View solution in original post

0 Karma
Highlighted

Re: Why are the logs are not being collected in CB Protection App for Splunk?

Communicator

Does anyone know if this app works with Splunk Enterprise 7.x*?

0 Karma
Highlighted

Re: Why are the logs are not being collected in CB Protection App for Splunk?

Communicator

@carbonblack when is a new version of this app being released that's compatible with Splunk Enterprise 7.x*?

0 Karma
Highlighted

Re: Why are the logs are not being collected in CB Protection App for Splunk?

Explorer

I don't know when the new version is coming out but the current version version works with Splunk 7.2.1.

0 Karma