Good Morning,
I am implementing Infoblox logs in Splunk and it is giving me problems. I have 3 Splunk machines, one is the Forwarder, another the Indexer and the other the Searcher. Both Forwarded and Searcher have Web App, the indexer on the other hand only works for CLI.
In the Forward machine, I installed Infoblox ActiveTrust Cloud Input Add-On, so that you can enter the logs into Splunk.
On the other hand, on the Searcher machine, I installed Infoblox ActiveTrust Cloud, which takes care of the visualization part.
In order for these 2 machines to be connected to each other, I had to create an index by hand in the Indexer through the CLI.
The problem comes when I already receive the logs in the Searcher, but they are full of errors like the ones attached in the following image:
Would anyone know how to explain if the problem comes from Splunk, when it comes to parsing the information, or instead, it comes from Infoblox when sending the logs, or even an error when creating the index by hand with the console (CLI)?
Greetings and thank you,
Carlos.
