Splunk Enterprise Security

Why are feeds occasionally failing to download to Splunk Enterprise Security threat intelligence via proxy?

ranjitbrhm1
Communicator

Good day everyone.

I have a query. I have configured all the Enterprise Security threat intelligence to download via a local proxy. The challenge that i face is sometimes the feeds seem to be failing to download. I would like to find out if there is a log file that is being written specifically with a reason as to why it fails to download or where to look for errors in splunk's _internal logs.

Thanks

0 Karma

harsmarvania57
Ultra Champion

Hi @ranjitbrhm1,

Please check $SPLUNK_HOME/var/log/splunk/threatlist.log on Search Head, you will able to find reason that why it is failing.

For example you will able to see log like this No content returned when querying https://isc.sans.edu/block.txt

0 Karma
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...