Hello, I've installed the Splunk App for CEF 2.0, configured the field mappings and destination syslog server, and pushed the generated TA to the indexers. When I run the search though that's generated with |cefout my_routing_group the python script is throwing an error that it's an invalid routing group, which makes sense because the only place that group is defined is in the outputs.conf in the TA that's generated to go to the indexers. Is this expected behavior? I don't see the data going to the /spool directory on the indexer. But, when I change the output group to 'cefroute' it sends the files to the spool directory on the search head. Any insight is appreciated. ... View more

Running into an issue with the latest version of the Splunk Add-on for Check Point OPSEC LEA. Everything is configured and connects properly with the LEA connection, but when lea_loggrabber fires up, it crashes with the following error: [ 21382 4152240960]@CIS-SPLUNKFWDW[18 Aug 12:26:24] PM_apply_default_dn: calling PM_policy_DN_conversion .. [ 21382 4152240960]@CIS-SPLUNKFWDW[18 Aug 12:26:24] PM_apply_default_dn: finished successfully. lea_loggrabber: ../sysdeps/unix/sysv/linux/getpagesize.c:32: __getpagesize: Assertion `_rtld_global_ro._dl_pagesize != 0' failed. Aborted Any ideas? ... View more