Carbon Black Cloud: Splunk shows "network connection error" trying to configure the CBC Splunk Add-on

[#1]

Environment

• Carbon Black Cloud Splunk Add-on: 1.x
• Splunk: 1.2.x

Symptoms

After configuring the Carbon Black Cloud Splunk Add-on, this error occurs in the Splunk dashboard:

error_message="Received a network connection error from https://defense-prod05.conferdeploy.net: 
   HTTPSConnectionPool(host='defense-prod05.conferdeploy.net', port=443): 
   Max retries exceeded with url: /appservices/v6/orgs/N5DFMV67/alerts/_search 
   (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x00000210EAB92448>: 
   Failed to establish a new connection: [WinError 10061] 
   No connection could be made because the target machine actively refused it'))

 

Cause

The "Proxy" tab of the configuration pages was misconfigured.

Resolution

The "Proxy" tab should have both of these options checked:

1. Use SSL
2. Verify SSL

Related Content

Carbon Black Cloud Splunk App - Carbon Black Developer Network