All Apps and Add-ons

Why can I not produce an alert in the integration of ForeScout App for Splunk?

gsales
New Member

Hi,

We are encountering a problem integrating ForeScout in Splunk. We installed the following:

  • ForeScout App for Splunk v2.7.0_2
  • ForeScout Adaptive Response Add-on for Splunk v2.7.0_2
  • ForeScout Technology Add-on for Splunk v2.7.0

We cannot produce an alert since it is encountering a Read operation timed out.
Appreciate your help. Thank you.

Please see below screenshot.
alt text

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@gsales,

I faced same issue. I found that there are so many background processes running by splunkd. I have configured so many apps and ES which cause splunkd slow to respond on immediate basis. So I think you have to check installed apps in that particular instance and do setup after disable app such apps if possible.

0 Karma

xpac
SplunkTrust
SplunkTrust

Hey,

the add-on seems to do something by contacting splunkd's REST API, which times out in your case.
Did you, by any chance, setup any firewall rules that might influence network connectivity?

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

0 Karma

gsales
New Member

Hi there xpac,

Thanks for your reply. Will ask the client about their network connectivity.
Will update as soon as we have a feedback.

Thank you.

0 Karma

xpac
SplunkTrust
SplunkTrust

This might be a local connection, i.e. the app tries to contact splunkd running on the same server. Usually such connectivity is not firewalled, but everything is possible. 😉

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...