Symantec WSS integration ingestion problem

Splunk Enterprise

Hi,

We have successfully integrate Symantec WSS integration in our platform, and we start to recieve events but since 3 weeks ago where the Symantec WSS product was fully deployed in the company and we start increase the volume of data the process of ingestion has stopped.

Making a debub of the proccess we have identify that the .zip files that the Heavy Forwarder is downloading are not well formed and when Splunk monitor those files splunk is not able to finish, have someone suffer this kind of error? Any advice?

Thanks for the help.

Get Updates on the Splunk Community!

Symantec WSS integration ingestion problem

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling

Join the Conversation

Symantec WSS integration ingestion problem

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Thanks for the Memories: .conf26 Took Learning to New Heights

Best Practices: Splunk auto adjust pipeline queue

Splunk Auto Ingestion Parallel Pipeline Scaling