remg427/misp42splunk

Splunk Cloud compatibility

Closed this issue · 2 comments

adrinavaascap commented

Hello,

I am trying to connect this app with a MISP instance by using Splunk Cloud. When I create the connection with the MISP server I did not get any traffic from Splunk on the MISP server. Is there any incompatibility between Splunk Cloud and this app?

Thank you very much in advance.

Munstar0s commented

the error we've been receiving after setting up MIS42Splunk is "Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability." would appreciate help in figuring out whether this is a splunk side issue or MISP instance as im unable to find any reference or solution on the net.

remg427 commented

Hello, I have submitted version 4.1.0 with requested update for cloud compatibility.
Appinspect is fine with automatic checks all good.
Now outcome is pending manual checks (13) but given reports should be fine

  • 👍1