Phantom Integration with splunk

Getting Data In

Hi,

I am using Distributed Splunk Enterprise Deployment (at Phantom end) to ingest phantom logs into splunk. CORE SIT Search Head IP is used here and it is working fine. But when we use ES SIT Search Head IP, I get the error - "Test connection failed for Phantom search on Host - xx.xx.xx.xx"

Telnet connectivity is working fine for both CORE and ES search heads

Why we are unable to connect with ES search head?

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...