Splunk Add-on for Check Point OPSEC LEA

[Navanitha]

I am collecting Firewall logs using OPSEC Lea app.  This add on is setup on Heavyforwarder.  App is setup correctly and logs are coming onto HF but I am unable to view them on Search head.  HF has connectivity to indexers is sending internal logs and other application related to indexers.  How do I check what is wrong with Checkpoint logs ?

[Navanitha]

Yes App is pulling logs and I did test is by enabling index and forward setting on HF.  No errors or Warning in app logs and index is created correctly.  I do see logs data transfer for this checkpoint on metrics.log also under  _internal index.  Unfortunately im unable to pastmetrics logs

[PickleRick]

Did you check that the app on HF actually pulls the logs? Did you check the app's logs? Do you have proper index configured in your input?