The Splunk app leverages the A4E Streaming Event API. This API requires read/write access. Also, it'll allow only five concurrent streams (a "stream", for this purpose, is the same as an "input" in the Splunk app - it's a set of event types and groups you'll pull from A4E). The streaming API doesn't do garbage collection, though, so when you delete an input in Splunk, you'd need to also manually delete the stream in the API; so keep an eye on that complexity." If you are still having trouble, you may want to reach out to Cisco TAC for support. ... View more

When the checkpoint add-on is trying to connect to the checkpoint server, it will try to resolve itself. When it is unable to do so, it will exit with a "segmentation fault" message. Add a host entry with the hostname of Splunk server and its IP in /etc/hosts and the segmentation fault should go away. ... View more

Some questions for you: - On what platform have you attempted to run the modified lea_loggrabber binary? - Do you get the "segmentation fault" error with the unmodified binary? - What output do you see when running lea_loggrabber from the command line? ... View more