I've configured the Check Point OPSEC LEA and the connection is fine. State is enabled. When I do a search with sourcetype=opsec, nothing returned.
Try to run the following debug script and got the following error message.
./splunk cmd $SPLUNK_HOME/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh
Log message:
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] Could not find info for ...opsec_client...
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_get_comm: Creating session hash (size=256)
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_get_comm: ADDING comm=0x85a5f48 to ent=0x85a62a0 with key=2
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_env_get_context_id_by_peer_sic_name: found context id=0 for peer sic name=CN=cp_mgmt,O=SENTINEL-ONE_Management_Server..fxugme
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_env_get_sic_handle_by_context_id: found sic handle (ctx id=0)
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] opsec_sic_connect: connecting... (ctx id=0)
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] resolver_gethostbyname: Performing gethostbyname for centos62-64sup03
[ 20591 4152015664]@centos62-64sup03[28 Aug 18:44:49] resolver_gethostbyname: Failed to resolve hostname 'centos62-64sup03'
[ 4152015664][28 Aug 18:44:49] fw_ipaddr: Unable to resolve ipaddr for centos62-64sup03
