All Apps and Add-ons

Splunk App for CEF not sending data

john_glasscock
Path Finder

After installing the app Splunk App for CEF and running through the setup. We have restarted the Splunk SearchHead. We have configured our CEF outputs and verified our query by using the preview window. We enable to output, I can see the logs are being created. However, we do not see any data leaving the SearchHead. I have run tcpdump on the SearchHead and no traffic is seen. We have even turned off IPTables just to be sure that is not blocking it.

We are running on RedHat 6.6.

Any suggestions would be welcomed at this point. We have open a case as well.
Thank you

sameeripro
Path Finder

what did you to make it running as i am not receiving the logs from Splunk to Arcsight connector

0 Karma

john_glasscock
Path Finder

I am now able to see the Splunk App for CEF sending data to a syslog-ng server and being saved as a file. However, when I look at the file, I do not see it being saved in cef format.

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

what do you see with this search?

index=_internal error | dedup punct
0 Karma

john_glasscock
Path Finder

I am not seeing anything that relates to the App for CEF when i go through the _internal errors from the search above.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Just to clarify, you installed the app on your search head, and you use that search head to collect the data? Have you set up proper forwarding to your indexer? And why are you using your search head to collect this data?

0 Karma

john_glasscock
Path Finder

The Splunk App for CEF is installed on a dedicated search, per the instructions, to query the data and then forward the results via CEF to a 3rd party i.e. ArcSight.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...