I have installed the CISCO AMP CIM add-on and the CISCo Add-on for AMP for EndPoints inputs. I can create the inupts but I am not getting any data in Splunk.
I keep getting the following messages in the amp4eeventsinput.log:
Connected. Starting to consume.
2018-01-15 15:28:39,399 INFO Amp4eEvents - Received response from ApiService (200)
2018-01-15 15:34:46,357 WARNING Amp4eEvents - Connection error (1516048486.36, : The AMQP connection was closed: ())! Reconnecting in about 3 seconds.
I have seen multiple INFO Amp4eEvents - Received response from ApiService (200) messages but I see no data in Splunk.