Hi
I have the app working great. I'm a bit confused on what DNSLB needs to get out. We're using a proxy to access the internet so I set the proxy settings for the domain user running splunk services (I just run IE as the splunk user and set proxy settings). This doesn't seem to work. I can't see any traffic going out from the fw either.
So basically I was wondering:
- Is there any other place where I have to set the proxy settings for this to work?
- Can I have the IPs for the Cisco servers so I can monitor the traffic going out?
Many thanks
Costas
The TA-SMTP-Reputation uses DNS to check the reputation, not HTTP. Your local DNS server must be able to resolve the DNS queries we are doing - there is no proxy involved.
Make sure your TA-SMTP-Reputation is up to date, that it is installed in $SPLUNK_HOME/etc/apps
and that it is producing data. You can run check_my_reputation.py manually using:
splunk cmd python check_my_reputation.py
and ensure it outputs reasonable data. One all that is done, you should be set.