Splunk Enterprise Security

Checkpoint R80.20 integration with Checkpoint

asharma21193
New Member

I am trying to integrate Checkpoint running on Gaia OS version R80.20 to heavy forwarder. I am using checkpoint log export utility. I am using tcp port 9000 as shown below.

I have also installed Checkpoint app on heavy forwarder just to ease the integration. After installing this app, I am able to see cp_log sourctype under ADD DATA tab. But I am not able to see index where I need to forward these logs. I am just able to see only 3 indexes ( summary, main and default). But I want to forward these logs into my specific index (india_firewall) already created on splunk cloud. is there any solution of this problem or should I use syslog in order to forward message.

name: splunk
status: Running (52900)
last log read at: 25 Dec 13:14:40
debug file: /opt/CPrt-R80.20/log_exporter/targets/splunk/log/log_indexer.elg

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!