Troubleshoot the Splunk Add-on for OSSEC

General troubleshooting

For helpful troubleshooting tips that you can apply to all add-ons, see "Troubleshoot add-ons". You can also access these support and resource links.

Data ingestion problems

Verify that you have configured the input correctly by confirming that:

• you have configured the correct IP address of the Splunk platform node responsible for data collection in your OSSEC configuration file.
• the port that you configured in your OSSEC configuration file matches the port you configured in your syslog input configuration.
• the port that you are using for this input does not conflict with any other inputs.
• your syslog input is configured to set the source type to ossec.
• you are searching the correct index. By default, this add-on uses the main index.