Splunk Enterprise Security

Problem integrating Infoblox in Splunk

New Member

Good Morning,

I am implementing Infoblox logs in Splunk and it is giving me problems. I have 3 Splunk machines, one is the Forwarder, another the Indexer and the other the Searcher. Both Forwarded and Searcher have Web App, the indexer on the other hand only works for CLI.

In the Forward machine, I installed Infoblox ActiveTrust Cloud Input Add-On, so that you can enter the logs into Splunk.
On the other hand, on the Searcher machine, I installed Infoblox ActiveTrust Cloud, which takes care of the visualization part.
In order for these 2 machines to be connected to each other, I had to create an index by hand in the Indexer through the CLI.

The problem comes when I already receive the logs in the Searcher, but they are full of errors like the ones attached in the following image:

alt text

alt text

Would anyone know how to explain if the problem comes from Splunk, when it comes to parsing the information, or instead, it comes from Infoblox when sending the logs, or even an error when creating the index by hand with the console (CLI)?

Greetings and thank you,

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...