Why can I not produce an alert in the integration of ForeScout App for Splunk?

[gsales]

Hi,

We are encountering a problem integrating ForeScout in Splunk. We installed the following:

• ForeScout App for Splunk v2.7.0_2
• ForeScout Adaptive Response Add-on for Splunk v2.7.0_2
• ForeScout Technology Add-on for Splunk v2.7.0

We cannot produce an alert since it is encountering a Read operation timed out.
Appreciate your help. Thank you.

Please see below screenshot.

[kamlesh_vaghela]

@gsales,

I faced same issue. I found that there are so many background processes running by splunkd. I have configured so many apps and ES which cause splunkd slow to respond on immediate basis. So I think you have to check installed apps in that particular instance and do setup after disable app such apps if possible.

[xpac]

Hey,

the add-on seems to do something by contacting splunkd's REST API, which times out in your case.
Did you, by any chance, setup any firewall rules that might influence network connectivity?

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

[gsales]

Hi there xpac,

Thanks for your reply. Will ask the client about their network connectivity.
Will update as soon as we have a feedback.

Thank you.

[xpac]

This might be a local connection, i.e. the app tries to contact splunkd running on the same server. Usually such connectivity is not firewalled, but everything is possible. 😉