topic Re: Help with Juniper SRX App - sourcetype=srx_traffic in All Apps and Add-ons

Help with Juniper SRX App - sourcetype=srx_traffic

mpegan — Tue, 24 Jul 2012 16:57:05 GMT

I loaded the app "Splunk for Juniper SRX". I'm running Splunk 4.3. I don't seen any data being popultaed into the app.

I can see the syslog data within the native seach app. When I click on the Juniper apps I get the following error.

The following messages were returned by the search subsystem:
DEBUG: base lispy: [ AND sourcetype::srx_traffic ]
DEBUG: search context: user="mpegan", app="SplunkforJuniperSRX", bs-pathname="/opt/splunk/etc"

I'm very new to Splunk and don't know how to troubleshoot this. Do I need to configure the sourcetype srx_traffic?

Any help is greatly appreciated. Thanks

Re: Help with Juniper SRX App - sourcetype=srx_traffic

MarioM — Tue, 24 Jul 2012 17:09:44 GMT

the sourcetype needs to be srx_log

There is a README in the apps folder SPLUNK_HOME/etc/apps/SplunkforJuniperSRX/

Re: Help with Juniper SRX App - sourcetype=srx_traffic

mpegan — Tue, 24 Jul 2012 19:02:05 GMT

oh man!

That did it. Thanks so much. I was so looking forward to this app.

Re: Help with Juniper SRX App - sourcetype=srx_traffic

MarioM — Wed, 25 Jul 2012 05:46:14 GMT

I am glad it did! Please accept my answer for those who have same issue to know this is the answer.Thanks

Re: Help with Juniper SRX App - sourcetype=srx_traffic

pollo123 — Thu, 26 Jul 2012 14:37:42 GMT

it seems that I cannot get any data, im using splunk port 514 for udp