Getting Data In

Phantom Integration with splunk

vijaysri
Builder

Hi,

I am using Distributed Splunk Enterprise Deployment (at Phantom end) to ingest phantom logs into splunk. CORE SIT Search Head IP is used here and it is working fine. But when we use ES SIT Search Head IP, I get the error  - "Test connection failed for Phantom search on Host - xx.xx.xx.xx"

Telnet connectivity is working fine for both CORE and ES search heads

Why we are unable to connect with ES search head?

vijaysri_0-1638327372336.png

 

Labels (2)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!