We are taking in infoblox logs via syslog and are getting inconsistent results. We have a clustered environment. The infoblox app is installed on a search head and the infoblox data is coming in via syslog on an indexer. On the indexer, the sourcetype is manually set to infoblox:file. The last several days, the branch to infoblox:dhcp and infoblox:dns worked perfectly. Over the last couple days we are now only seeing infoblox:file, as if the sourcetype branches are no longer working. On the search head, we've verified the sourcetypes and the transforms. I can't seem to figure out why this is occurring. Do we need to install the infblox app on the indexer as well? This breaks Splunk Common Information Model (CIM) compliance and by extension Splunk Enterprise Security. Any advice on troubleshooting?
Splunk Add-on for Infoblox Splunk_TA_infoblox 1.0.2
