Good morning
We deployed the Optiv Threat intel and the TA in our prem environment.
We use Splunk Enterprise on this configuration:
1 Search Head
2 Indexers
1 Heavy Forwarder
The Optiv Threat Intel is in the Search Head, The Optiv TA is in the Heavy Forwarder.
We use RHEL and the install path is /opt/splunk
We created the optiv index in both indexers(index name: it_optiv)
We ran the starter script without any errors.
We still have no data in the Optiv Dashboards after 24 hours.
The Heavy forwarder does communicate with the indexers as we do have other data sources using it successfully.
Anything else that we are missing or misconstruing?
We do appreciate any help.
