- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why are feeds occasionally failing to download to Splunk Enterprise Security threat intelligence via proxy?

ranjitbrhm1
Communicator
09-26-2018
04:34 AM
Good day everyone.
I have a query. I have configured all the Enterprise Security threat intelligence to download via a local proxy. The challenge that i face is sometimes the feeds seem to be failing to download. I would like to find out if there is a log file that is being written specifically with a reason as to why it fails to download or where to look for errors in splunk's _internal logs.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

harsmarvania57
Ultra Champion
09-26-2018
07:34 AM
Hi @ranjitbrhm1,
Please check $SPLUNK_HOME/var/log/splunk/threatlist.log
on Search Head, you will able to find reason that why it is failing.
For example you will able to see log like this No content returned when querying https://isc.sans.edu/block.txt
