topic Where is the option to set the data source for apps? in Getting Data In

Where is the option to set the data source for apps?

skoszegi — Wed, 15 Apr 2015 11:52:07 GMT

Hi All,

My scenario: I receive log files from a customer which I need to analyze and build reports from it. I was able to import the data into Spunk, but it can't seem to work with any app I tried. I couldn't find the option to set data source for apps, are they only working with "forwarded" data?

Thanks,
Szabolcs

Re: Where is the option to set the data source for apps?

gyslainlatsa — Wed, 15 Apr 2015 12:05:51 GMT

hi skoszegi,

click on the application search and reporting
click on summary data and verified sources and sourcetype presents in your splunk machine to see if the source are not displayed.
here's a figure to help.
let me know for the future.
please forgive my english.

Re: Where is the option to set the data source for apps?

skoszegi — Wed, 15 Apr 2015 12:10:26 GMT

Hi,

Thanks for your answer. I already checked it and I can see it in the sources and search. But if I open for example the Cisco app, it shows no data but there are Cisco logs in these sources.

Re: Where is the option to set the data source for apps?

gyslainlatsa — Wed, 15 Apr 2015 12:22:27 GMT

your work with what apps?

Re: Where is the option to set the data source for apps?

skoszegi — Wed, 15 Apr 2015 12:37:13 GMT

Splunk App for Checkpoint, Cisco Networks

Re: Where is the option to set the data source for apps?

btt — Wed, 15 Apr 2015 12:55:10 GMT

In data summary page (page show by gyslainlatsa), select Sources
and in the displayed list click on your source to see if you have events

Re: Where is the option to set the data source for apps?

skoszegi — Wed, 15 Apr 2015 12:58:35 GMT

Yes I have events there and I'm they are visible in the Searching & reporting app but not in other apps.

Re: Where is the option to set the data source for apps?

aweitzman — Wed, 15 Apr 2015 13:12:30 GMT

Many apps require that the data needs to flow through a particular add-on into Splunk. For instance, the blurb for the CheckPoint app indicates that it requires the data to be "collected using the Splunk Add-on for Check Point OPSEC LEA" for it to work. There are many Cisco apps, so I'm not sure which one you're using, but it may have similar requirements.

Re: Where is the option to set the data source for apps?

skoszegi — Wed, 15 Apr 2015 13:15:24 GMT

Oh that could be an issue! Will install the add-on and see if it works.

Thanks

Re: Where is the option to set the data source for apps?

gyslainlatsa — Wed, 15 Apr 2015 13:15:28 GMT

for your apps Splunk App for Checkpoint, Cisco Networks, following this link for the best configurations
http://docs.splunk.com/Documentation/OPSEC-LEA/2.1.1/Install/InstalltheSplunkTechnologyAdd-onforCheckPointOPSECLEA