Jamf Protect and Splunk Integration Issues

[btluynk]

Hi team, 

I've completed all the configurations according to the steps provided in the following link for integrating Jamf Protect and Splunk:

https://learn.jamf.com/bundle/jamf-protect-documentation/page/Splunk_Integration.html

Under the "Testing the Event Collector Token" section, when I execute the command as instructed in "Using the values obtained in step 1," I can see the log I sent from my local machine on the Splunk search head. However, logs from other clients, especially JamfPro logs, are not visible. I can confirm that the logs are being captured by using tcpdump on the heavy forwarder, but they are not appearing in search results. What could be the reason for this?

Additionally, where can I check error logs from the CLI to investigate this further?

Thanks