Troubleshoot the Splunk Add-on for Carbon Black

For helpful troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons.

For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Unexpected HEC event wrapper

If the event received in Splunk has the following structure:

{
    "sourcetype": "<src_type>",
    "event": "<event>"
}

This structure indicates that the Carbon Black Event Forwarder is sending an HEC event wrapper instead of the delimiter-separated raw events expected by this add-on.

Solution

Verify that the [splunk] stanza in cb-event-forwarder.conf contains the following template:

http_post_template={{range .Events}}{{.EventText}}"||"{{end}}

Use the HEC raw endpoint with this template:

splunkout = https://<your-splunk-HEC-endpoint>:8088/services/collector/raw

If your HEC token has Indexer Acknowledgement enabled, add a unique GUID as the channel ID. Splunk uses this value to track acknowledgements:

splunkout = https://<your-splunk-HEC-endpoint>:8088/services/collector/raw?channel=<unique_channel_id>

After making the above changes, restart the Carbon Black Event Forwarder for the changes to take effect:

systemctl restart cb-event-forwarder