topic Re: Not getting data from DELL SonicWall Analytics App in All Apps and Add-ons

Not getting data from DELL SonicWall Analytics App

rodgerkrau — Fri, 22 Apr 2016 21:03:13 GMT

Dashboard not working. I believe I need to edit the sonicwall_firewalls.csv but not sure of the exact context. This is whats in there now:

host, firewall_name
127.0.0.1, localhost
1.1.1.1, "Sample Host"
"localhost:2055", "IPFix Convert"

Note: I am getting syslog data over UDP port 514 from the same device I'm trying to pull from.

Re: Not getting data from DELL SonicWall Analytics App

Richfez — Sat, 23 Apr 2016 03:04:19 GMT

It seems unlikely that would prevent the dashboard from working, but unlikely is not the same as impossible.

You'll probably want to put, as a new line,

1.2.3.4, "My firewall's name"

in there, where 1.2.3.4 is its IP and the rest is a string "name" for it.

If that works, great!

If not, post back. It might help quite a bit if you could edit one of the dashboard panels and find the search string in it and paste that in here. That will tell us a lot about how that app expects to see its data (without making us download the app and examine it ourselves, that is).

BTW, USUALLY these sorts of issues end up being index related. The data is going into a different index than what the dashboards expect, or the permissions are set on the role in such a way that the user logged in doesn't search the particular index needed by default or can't search it at all. Probably the second biggest reason these sorts of issues crop up is the app just fails to tag (generic word, not exactly and precisely the "tag" capability inside Splunk) your events properly (which can often be an input problem like you aren't assigning the right sourcetype on the input or something, but there are other various reasons for this sometimes too).

Re: Not getting data from DELL SonicWall Analytics App

rodgerkrau — Tue, 29 Sep 2020 09:32:40 GMT

stopped the splunk service. added a new line (didnt remove any lines) and started splunk service.
Now get an error: received event for unconfigured/disabled/deleted index='sonicwall' with source='source::dell_ipfix://Dell_IPFIX' host='host::localhost:2055' sourcetype='sourcetype::dell_ipfix' (1 missing total)

xxx.xxx.xxx.xxx, "My SonicWall"
host, firewall_name
127.0.0.1, localhost
1.1.1.1, "Sample Host"
"localhost:2055", "IPFix Convert"

Re: Not getting data from DELL SonicWall Analytics App

rodgerkrau — Tue, 29 Sep 2020 09:32:42 GMT

Here is one of the dashboard search strings: index=sonicwall tid=257 OR tid=357 OR tid=458 | timechart span=1h sum(init_to_resp_octets) as "outbound", sum(resp_to_init_octets) as "inbound" | addtotals

permissions appear to be correct. I am an admin on the system

Re: Not getting data from DELL SonicWall Analytics App

Richfez — Mon, 25 Apr 2016 14:29:03 GMT

You have an index with the name "sonicwall"? Your other comment indicates you've checked that, but that error means .... oh, it probably missed an event while you had services down, that's probably all. So, try this search:

index=sonicwall

What's that give?

Actually, if that returns hits do

index=sonicwall | count by tid

That way we can kill two birds with one stone.

Are you on the IRC or Slack channel? These sorts of interactive back-and-forth troubleshooting is often easier in that forum (then we can come back here and provide the steps and resolution).

Re: Not getting data from DELL SonicWall Analytics App

rodgerkrau — Tue, 26 Apr 2016 12:56:21 GMT

ok, I noticed the index was set for "main" so I changed to sonicwall. index = sonicwall now showing data however dashboards still not populating data.. I can only post on this forum twice a day. Can we troubleshoot via email? and then post solution once resolved?

Re: Not getting data from DELL SonicWall Analytics App

Richfez — Thu, 28 Apr 2016 11:58:35 GMT

Resolution took a bit of back and forth.

Deeper inspection of the events he had showed only lines like

tid=555 total_data_count=0 total_data_size_kb=0 total_discard_count=0

In his sonicwall index. This is the same sorts of summary events I got when I tested the app (and I have NO sonicwall), so it became clear the data was NOT actually coming in.

We double-checked the setup instructions and those did seem to have been completed properly. Rodgerkrau sniffed some traffic with Wireshark and confirmed that the data wasn't getting there.

It turned out the router vpn from the sonicwall IP had to be reset to 0.0.0.0 and the data started flowing.

All is better now!

Re: Not getting data from DELL SonicWall Analytics App

seanduchstein — Thu, 16 Mar 2017 17:00:57 GMT

Could you please explain in greater detail your solution? Are you talking about the setting: "Source IP to Use For Collector On A VPN Tunnel"?