topic Re: Reporting only one unique device in All Apps and Add-ons

Reporting only one unique device

cboillot — Wed, 05 Jul 2017 15:24:16 GMT

The dashboard is only showing me that I have 1 unique device. Digging into it, It looks like it is seeing the syslog server as the only device. I notice that some of the fields do have a "reported_hostname" field. How do I get those entries have have this to show this as the host field?

Re: Reporting only one unique device

adonio — Wed, 05 Jul 2017 16:19:24 GMT

please provide more info, what kind of devices are those?
are you using any of the pre-built splunk apps?
also might be related to how you write data to syslog
hope it slightly helps

Re: Reporting only one unique device

cboillot — Wed, 05 Jul 2017 16:51:57 GMT

several different kinds. we have routers, switches, ASAs, ect.

We are using the "Cisco Networks App for Splunk Enterprise" and the "Splunk Add-on for Cisco Networks"

Re: Reporting only one unique device

adonio — Wed, 05 Jul 2017 17:07:52 GMT

how do you bring the data from syslog to splunk? universal forwarder? directly over TCP / UDP?

Re: Reporting only one unique device

cboillot — Wed, 05 Jul 2017 17:14:52 GMT

universal forwarder

Re: Reporting only one unique device

adonio — Wed, 05 Jul 2017 17:16:14 GMT

what is the sourcetype you have under your inputs stanza?

Re: Reporting only one unique device

cboillot — Wed, 05 Jul 2017 17:23:07 GMT

cisco:ios

Re: Reporting only one unique device

adonio — Wed, 05 Jul 2017 17:38:27 GMT

do you have the TA installed?
https://splunkbase.splunk.com/app/1467/#/details

Re: Reporting only one unique device

cboillot — Wed, 05 Jul 2017 19:10:22 GMT

Yes, it is showing as being installed. Version 2.3.4.

Re: Reporting only one unique device

adonio — Thu, 06 Jul 2017 01:29:01 GMT

can you kindly share your inputs.conf on the forwarder?

Re: Reporting only one unique device

cboillot — Thu, 06 Jul 2017 13:29:54 GMT

[default]
ignoreOlderThan = 10d
blacklist = \.(gz|bz2|z|zip)$
recursive = false
index = main

[monitor:///var/agency_logs/AgencySyslog]
sourcetype=cisco:ios

Re: Reporting only one unique device

adonio — Thu, 06 Jul 2017 17:21:22 GMT

are all devices placing their data in one folder, AgencySyslog?

Re: Reporting only one unique device

cboillot — Thu, 06 Jul 2017 20:47:55 GMT

They are all placing their data into the single file AgencySyslog.

Re: Reporting only one unique device

adonio — Fri, 07 Jul 2017 01:06:06 GMT

i believe this link will l be helpful:
https://www.splunk.com/blog/2016/03/11/using-syslog-ng-with-splunk.html
worthwhile to look at those as well:
http://www.georgestarcher.com/splunk-success-with-syslog/
https://www.function1.com/2012/05/syslog-collection-with-splunk
hope it helps

Re: Reporting only one unique device

cboillot — Mon, 10 Jul 2017 13:47:08 GMT

I will pass this information along and see what happens. Thank you.

Re: Reporting only one unique device

cboillot — Thu, 13 Jul 2017 15:19:20 GMT

so, they redid the directories and now we have this:

/var/agency_logs/cisco/ios/<hostname>/<syslogfacility-text>/<syslogseverity-text>/<year-month-day>.log

and I have that entered in as

[monitor:///var/agency_logs/cisco/ios/*/local7/*/*.log]
host_segment = 5

However, these are not being pulled in for some reason.

Re: Reporting only one unique device

adonio — Tue, 29 Sep 2020 14:52:10 GMT

try this:
[monitor:///var/agency_logs/cisco/ios/.../local7/.../*.log]
host_segment = 5

Re: Reporting only one unique device

cboillot — Thu, 13 Jul 2017 16:28:45 GMT

Done. But it still isn't pulling the data in.

here is my inputs.conf file:

[default]

ignoreOlderThan = 10d
blacklist = \.(gz|bz2|z|zip)$
recursive = false
index = main
# index = enterprise_90days
sourcetype = cisco:ios
crcSalt = <SOURCE>

# Windows platform specific input processor.

[monitor:///var/agency_logs/cisco/ios/.../local7/.../*.log]
host_segment = 5

# [monitor:///var/agency_logs/AgencySyslogWLC]

# [monitor:///var/agency_logs/AgencySyslog]

Re: Reporting only one unique device

adonio — Thu, 13 Jul 2017 16:38:42 GMT

can you double check the full path to file and compare with examples here:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/Data/Specifyinputpathswithwildcards

Re: Reporting only one unique device

cboillot — Wed, 19 Jul 2017 16:52:52 GMT

So I fixed my issue. I took the local7 out of the monitor stanza, and, this is the most important change, I changed recursive to true.