After installing the app Splunk App for CEF and running through the setup. We have restarted the Splunk SearchHead. We have configured our CEF outputs and verified our query by using the preview window. We enable to output, I can see the logs are being created. However, we do not see any data leaving the SearchHead. I have run tcpdump on the SearchHead and no traffic is seen. We have even turned off IPTables just to be sure that is not blocking it.
We are running on RedHat 6.6.
Any suggestions would be welcomed at this point. We have open a case as well.
Thank you
↧