topic Why is Fortinet sourcetype renaming not working? in Getting Data In

Why is Fortinet sourcetype renaming not working?

aamer86 — Fri, 18 Feb 2022 22:34:46 GMT

Hi,

I have clustered multi-site indexing architecture with search head cluster.

I am getting the fortinet logs as below:

Fortinet ==> Syslog ==> HF monitor the logs >> Indexers (index discovery)

I installed the fortinet add-on on all indexers and searchheads
I still see logs coming under the sourcetype I defined in the inputs.conf for monitoring

I added below a list of apps I pushed to Peers and SHs

@fortinet @fortinet1

Re: Why is Fortinet sourcetype renaming is not working?

richgalloway — Fri, 18 Feb 2022 18:38:26 GMT

1. How are you trying to rename the sourcetype?

2. The TAs should be installed on the HF, too.

Re: Why is Fortinet sourcetype renaming is not working?

aamer86 — Mon, 04 Apr 2022 19:02:38 GMT

Thanks @richgalloway installing the Add-On on the HF fixed it