Jamf Protect and Splunk Integration Issues

Getting Data In

Hi team,

I've completed all the configurations according to the steps provided in the following link for integrating Jamf Protect and Splunk:

https://learn.jamf.com/bundle/jamf-protect-documentation/page/Splunk_Integration.html

Under the "Testing the Event Collector Token" section, when I execute the command as instructed in "Using the values obtained in step 1," I can see the log I sent from my local machine on the Splunk search head. However, logs from other clients, especially JamfPro logs, are not visible. I can confirm that the logs are being captured by using tcpdump on the heavy forwarder, but they are not appearing in search results. What could be the reason for this?

Additionally, where can I check error logs from the CLI to investigate this further?

Thanks

Get Updates on the Splunk Community!

Jamf Protect and Splunk Integration Issues

administration

configuration

installation

troubleshooting

using Splunk Enterprise

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

Announcing Modern Navigation: A New Era of Splunk User Experience

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

Join the Conversation

Jamf Protect and Splunk Integration Issues

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.