topic Re: Getting data into Splunk from Aruba Controller in Splunk Enterprise

How to get data into Splunk from Aruba Controller?

heathramos — Tue, 07 Jun 2022 16:18:30 GMT

I am trying to forward log files from our Aruba Controller to Splunk but not sure how to configure the data input

I set up a data input of UDP port 514 but what should the source type be?

aruba:syslog?

The Aruba Controller has an option for syslog formatting of either CEF or RFC 3164.

Which format is more Splunk friendly?

Re: Getting data into Splunk from Aruba Controller

scelikok — Wed, 03 Mar 2021 20:20:19 GMT

Hi @heathramos,

You should better use Aruba NetworksAdd-on for Splunk (https://splunkbase.splunk.com/app/4668/#/details )

It expects sourcetype as aruba:syslog. The add-on will rename sourcetypes to correct ones according to message contents.

Re: Getting data into Splunk from Aruba Controller

heathramos — Wed, 03 Mar 2021 21:31:52 GMT

Thanks

On Splunk, I installed the Aruba Networks Add-on for Splunk, created the udp:514 data input, specified aruba:syslog as source type and placed it in a wifi index.

On Aruba controller, I forwarded logs to Splunk.

The events in Splunk look different than I'm used to. It may just be because its not from a Windows box. Some events have multiple records in it. It made me thing the data wasn't getting parsed correctly.

Re: Getting data into Splunk from Aruba Controller

morganalton — Tue, 07 Jun 2022 15:22:22 GMT

@heathramos

Do you remember what you you needed to run for the controller to forward the logs to splunk? Ive done everything else on the Splunk side but havent figured out what to run on the WC. Any help would be greatly appreciated!