Netskope onboarding

[tech_g706]

Hi,

I have a question on Netskope onboarding to Splunk.

I installed to TA-NetSkopeAppForSplunk (4.1.0) on Splunk cloud and configured the API tokens provided by Netskope, and logs are flowing.

However, the same add-on and tokens are configured on Splunk Enterprise (Intermediate Heavy Forwarder), and logs are not arriving. I tried using multiple local Splunk Enterprise instances for testing, and no logs.

Any recommendations on what could be the issue with the Enterprise version while it is working fine on Cloud?

[tech_g706]

Thanks,

Upon checking the logs, it seems MongoDB is not running on the heavy forwarder, and that would be required.

ta_netskopeappforsplunk_netskope_alerts_v2.log
splunklib.binding.HTTPError: HTTP 503 Service Unavailable -- KV Store initialization failed.

2: splunkd.log:
ERROR KVStoreConfigurationProvider [15442 KVStoreConfigurationThread] - Failed to start mongod on first attempt reason=KVStore service will not start because kvstore process terminated
 ERROR KVStoreConfigurationProvider [15442 KVStoreConfigurationThread] - Could not start mongo instance. Initialization failed.
 ERROR KVStoreBulletinBoardManager [15442 KVStoreConfigurationThread] - Failed to start KV Store process. See mongod.log and splunkd.log for details.
INFO  KVStoreConfigurationProvider [15442 KVStoreConfigurationThread] - Mongod service shutting down

[livehybrid · Accepted solution]

Hi @tech_g706 

 I think the first thing you need to establish is whether you are able to connect to Netskope from your HF on premise.

Then also check your internal logs to see if there were any errors around the collection of these events.

If it looks like the events are collecting then you need to work out why the data is not sending from that forwarder to your indexers.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing