Symantec WSS integration ingestion problem

Splunk Enterprise

Hi,

We have successfully integrate Symantec WSS integration in our platform, and we start to recieve events but since 3 weeks ago where the Symantec WSS product was fully deployed in the company and we start increase the volume of data the process of ingestion has stopped.

Making a debub of the proccess we have identify that the .zip files that the Heavy Forwarder is downloading are not well formed and when Splunk monitor those files splunk is not able to finish, have someone suffer this kind of error? Any advice?

Thanks for the help.

Get Updates on the Splunk Community!

Symantec WSS integration ingestion problem

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Symantec WSS integration ingestion problem

configuration

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...