Reporting

PingFederate App Forwarded Events goto Splunk_Audit_Too_Small

lew00
New Member

Hi have a new install with a single Splunk server for evaluation.  I set up the universal forwarder and the Splunk service on Centos and updated the PingFederate to create the require splunk audit file.  I then configured the receiver and the sender to use the /opt/pf/pingfederate/log/splunk_audit.log

 

Entries started to flow from the forwarder to the Splunk indexer but all the PingFederate App panes show "waiting for input".  From the search I see the data event flowing but they all say Splunk_Audit_Too_Small

Any Tips how to fix this?

 

Thanks!

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...