I am currently using Splunk Enterprise 8.0.3 and Phantom version 4.8.24304. All Phantom apps have been installed and are configured correctly. In Splunk Web, I have successfully configured the Phantom Server in the App, and applied the Splunk Enterprise instance IP under the "allowed ips" in Phantom. I have tried two ways of forwarding data into Phantom from Splunk; through the event forwarding of saved searches and through the HTTP Event Collector (HEC). Splunk Web and Phantom are on two different VM, I am not able to connect utilizing the HEC in Phantom under the Search Settings option, and the saved search for event forwarding never appears in Phantom. For the HEC, I used the following URL: hxxp://splunk_host:8088/services/collector/event . Each time whether using http or https, the request 404's out. The saved search function allows me to choose to "Send to Phantom", but again I am not seeing any events in Phantom. I have verified connectivity between the VM's and there are no issues there. The problem lies somewhere with my HEC and the saved searches for forwarding. My VM is listening on port 8088 for HEC. Any help would be greatly appreciated.
... View more
