Getting Data In

Phantom Integration with splunk

VijaySrrie
Builder

Hi,

I am using Distributed Splunk Enterprise Deployment (at Phantom end) to ingest phantom logs into splunk. CORE SIT Search Head IP is used here and it is working fine. But when we use ES SIT Search Head IP, I get the error  - "Test connection failed for Phantom search on Host - xx.xx.xx.xx"

Telnet connectivity is working fine for both CORE and ES search heads

Why we are unable to connect with ES search head?

vijaysri_0-1638327372336.png

 

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...