Trouble with TA-Juniper

[Kate_Lawrence-G]

I have a Juniper firewall that forwards syslog/udp:514 data from a forwarder to an indexer in one of my 2 production data centers (DC1 and DC2)

I have installed the TA-Juniper app on each of the indexers thru a deployment server and they are setup identically.

However the app is working correctly in DC1 and NOT in DC2.

The app exists in the same location and there are no networking issues between the forwarder/indexer or search head.

On the indexer that is NOT working I've run:

./splunk cmd btool transforms list --debug | grep TA-juniper | more./splunk cmd btool transforms list --debug | grep TA-juniper | more

and confirmed that the transforms are in place and the app is enabled.

Data from the forwarder in DC2 is being received at the indexer but is defaulting to the syslog sourcetype. It's like the indexer is completely ignoring the TA-juniper app?

I've restarted the indexer a couple of times with no change in behavior.

[LukeMurphey]

Kate,

When you say "I have a Juniper firewall that forwards syslog/udp:514 data from a forwarder", are you using a full forwarder? If so, then you will need to deploy TA-Juniper at the forwarder. I recognize that this would not explain why one indexer is working and the other is not but may be contributing to the problem.

If this is not the case, could you please open a ticket with support and provide diags? This will make it much easier for Splunk to get a handle on the root cause.