All Apps and Add-ons

Why can I not produce an alert in the integration of ForeScout App for Splunk?

gsales
New Member

Hi,

We are encountering a problem integrating ForeScout in Splunk. We installed the following:

  • ForeScout App for Splunk v2.7.0_2
  • ForeScout Adaptive Response Add-on for Splunk v2.7.0_2
  • ForeScout Technology Add-on for Splunk v2.7.0

We cannot produce an alert since it is encountering a Read operation timed out.
Appreciate your help. Thank you.

Please see below screenshot.
alt text

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gsales,

I faced same issue. I found that there are so many background processes running by splunkd. I have configured so many apps and ES which cause splunkd slow to respond on immediate basis. So I think you have to check installed apps in that particular instance and do setup after disable app such apps if possible.

0 Karma

xpac
SplunkTrust
SplunkTrust

Hey,

the add-on seems to do something by contacting splunkd's REST API, which times out in your case.
Did you, by any chance, setup any firewall rules that might influence network connectivity?

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

0 Karma

gsales
New Member

Hi there xpac,

Thanks for your reply. Will ask the client about their network connectivity.
Will update as soon as we have a feedback.

Thank you.

0 Karma

xpac
SplunkTrust
SplunkTrust

This might be a local connection, i.e. the app tries to contact splunkd running on the same server. Usually such connectivity is not firewalled, but everything is possible. 😉

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...