Brandon, Can you please check whether the Splunk user has read access to the `/var/ossec/logs/alerts/alerts.json`. This was the reason for me why the data from Wazuh manager to external index was not forwarding. I added spunk user to the ossec group. After that it started working. Please let me know if you have any questions. Thanks.
# ls -l /var/ossec/logs/alerts/alerts.json -rw-r----- 2 ossec ossec 13661196 Feb 27 11:29 /var/ossec/logs/alerts/alerts.json # groups splunk splunk : splunk ossec On Wed, Feb 27, 2019 at 10:12 AM 'Brandon' via ossec-list < [email protected]> wrote: > Has anyone successfully gotten Wazuh OSSEC data to an external instance of > Splunk? Our Splunk admin is following the guide and we're having issues > getting the logs to go into it. The app is configured and it'showing the > agents in there, but the data is not passing. They had asked Splunk but > they were not much help and there was a thread asking for understanding of > instructions but no answer ( > https://answers.splunk.com/answers/681036/how-to-configure-the-wazuh-app-to-get-data-into-sp.html > ). > > Thanks in advance, > ~Brandon > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
