zScaler LSS Log Ingestion

[omranb]

I have a set up a single-node test instance of Splunk to try and ingest zScaler LSS (not NSS) logs via a TCP input. However, it is not ingesting any data, despite being able to see traffic via TCPDump on that port

I have installed the latest zScaler Splunk App (v2.0.7) and the zScaler Technical Add-on (v3.1.2)

[root@ip-10-127-0-113 apps]# ls | grep scaler
TA-Zscaler_CIM
zscalersplunkapp

via the WebUI, I have set up a TCP input on port 10000, set the sourcetype, app and index options.

I have checked to make sure that Splunk is listening on TCP/10000 and can see that it is

[root@ip-10-127-0-113 apps]# netstat -antp | grep 10000
tcp        0      0 0.0.0.0:10000           0.0.0.0:*               LISTEN      7992/splunkd
tcp        0      0 10.127.0.113:10000      x.x.x.x:38392     SYN_RECV    -
tcp        0      0 10.127.0.113:10000      x.x.x.x:51586     SYN_RECV    -
tcp        0      0 10.127.0.113:10000      x.x.x.x:53844     SYN_RECV    -

I can't see any errors in the _internal index (although I could be searching wrong). I'm using the below search:

index=_internal "err*"

The only errors I can see relate to the 'summarize' command.

Any pointers would be really appreciated.

Many thanks,