So to be clear, you have your indexer listening on port 5515 / configured in its inputs.ocnf and your heavy forwarder sending traffic to port 5515 via it's outputs.conf file? And your saying that it does not work as expected? ... View more

1) Did you configure the OPSEC LEA object in your CheckPoint manager? You then need to establish a session with a one-time password between your manager and your HF. It's all here: http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Setup 2) No I did not make any changes on the indexer as the parsing provided by the app was good enough. If you can't see any logs flowing take a look at the troubleshooting section first: http://docs.splunk.com/Documentation/AddOns/released/OPSEC-LEA/Troubleshoot If that doesn't help, raise a new question with the specific details of your problem as you will get a much wider audience that way. Please keep in mind this post was referred to version 3 and not 4 of the OPSEC LEA app. Thanks, J ... View more

Keep in mind that since your running the application from 1 indexer the data will be on 1 indexer of your cluster (plus any replication settings you have...). ... View more

I can not find any documentation specifically addressing the install on a HF. I have gathered from reading answers by the community to not index on the HF (common sense but documentation does not address what to add in the inputs.conf), assuming the outputs.conf is straight forward but then the app configuration on the indexer is also not clear. ... View more