1. Configured CB Protection application to export logs.
2. Installed CB Protection App on the Splunk Server.
3. Installed CB Protection App on all the Indexers.
4. Installed UF and CB Protection App on the CB Protection Server
a. Configured the App to forward logs.
b. Checked logs on CB Protection server in /var/log/splunk/splunkd.log
08-08-2018 08:11:33.776 -0400 INFO TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:12:33.744 -0400 INFO TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
08-08-2018 08:13:03.448 -0400 INFO TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997, pset=0, reuse=0.
... View more