All Apps and Add-ons

Splunk App for CEF: Issue with sending events from Splunk indexers

splunker969
Communicator

Hi,
We are able to configure Splunk App for CEF and after updating we're able to map fields and output group. Since we're unable to test that events are leaving from Splunk when we tested last week for testing purpose. Since we were trying to send logs now. No logs are leaving from indexers we double checked the firewall rule it is allowing. We see no traffic is being left from Splunk Indexers? Means there might be a problem with Splunk side.

Any Thoughts what would be a problem? Any Help, please?

1 Solution

rpille_splunk
Splunk Employee
Splunk Employee

I suggest working through each of these troubleshooting steps, in order: http://docs.splunk.com/Documentation/CEFapp/2.0.1/DeployCEFapp/Troubleshoot#No_data_is_arriving_at_r...

If you have completed those steps and you still can't find the issue, I suggest opening a Support case.

View solution in original post

rpille_splunk
Splunk Employee
Splunk Employee

I suggest working through each of these troubleshooting steps, in order: http://docs.splunk.com/Documentation/CEFapp/2.0.1/DeployCEFapp/Troubleshoot#No_data_is_arriving_at_r...

If you have completed those steps and you still can't find the issue, I suggest opening a Support case.

splunker969
Communicator

Thanks @ rpille

0 Karma
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...