Good morning! We have a complex architecture with multiple indexers and couple search heads one of which we have full control of. When trying to configure CEF Addon to send events to our CEF receiver, we have realized that we need to install the configured addon to all indexers we have which is kind complicated thing because we have many and they are distributed across different data centers and regions. Is it possible to configure Search Head to be a main CEF events forwarder without involving indexers at all? Thank you. ... View more

Good afternoon. We have installed latest version of CEF app. to our Splunk 6.5.2. Plugin is enabled, field mapping is configured, network connection working fine, but logs are not being forwarded by the app at all. The reason for this (as I see it) is that App fails at the last (finish and export) stage of configuration. When we press the "Export outputs" button, app is stuck on "Generating TA" step and it's not going forward leaving changes uncommitted. We've tried to debug this using chrome dev. console and found that 404 is returned when pressing the button: The exact link behind this 404 URL is: https://splunk-instance/custom/splunk_app_cef/cef_utils/maketaforindexers But, if you change the URL to include the language and locality, like: https://splunk-instance/en-US/custom/splunk_app_cef/cef_utils/maketaforindexers It works and the result is returned! Digging into the source code of 2.0.1, this is what we've found. Look at the last line: root@root MINGW64 /c/d/ddir/20171207/splunk_app_cef $ find . -type f| xargs grep "maketa" ./appserver/controllers/cef_utils.py: @route("/:maketaforindexers=maketaforindexers") ./appserver/controllers/cef_utils.py: def maketaforindexers(self, **kwargs): grep: ./appserver/static/js/lib/DataTables/images/Sorting: No such file or directory grep: icons.psd: No such file or directory ./appserver/static/js/views/DownloadIndexerAppView.js: var uri = Splunk.util.make_url("../../custom/splunk_app_cef/cef_utils/maketaforindexers"); Which means that if we make look like: Splunk.util.make_url("../custom/splunk_app_cef/cef_utils/maketaforindexers"); It will probably work. Can somebody confirm that this is a pure bug? What shall we do with it? Thank you. ... View more