Splunk Lea Client unable to fetch logs from Secondary Smart1-25 Manager (R77.30)

[sarish.amrithlall]

Good day,

I have an issue with Splunk Lea Client that is unable to fetch logs from Secondary Smart1-25 Manager (R77.30). The Splunk client can connect and authenticate(trust established) to the Secondary Manager but does not fetch the logs. The Primary Manager is down and not available.

Did anyone experience this issue before.

Thanks

[jflemingeds]

Good day,

I have an issue with Splunk Lea Client that is unable to fetch logs from Secondary Smart1-25 Manager (R77.30). The Splunk client can connect and authenticate(trust established) to the Secondary Manager but does not fetch the logs. The Primary Manager is down and not available.

Did anyone experience this issue before.

Thanks

There isn't much to LEA connections. You basically set sic and then its up to the client application (Splunk in this case) to connect to the device (your secondary manager) and request logs. I would check to see if you see any tcp connections hitting the secondary. If not then you need to call Splunk and ask them why its not attempting.