topic Re: How to index Infoblox data in Splunk? in Getting Data In

How to index Infoblox data in Splunk?

pbernardin — Tue, 13 Jan 2015 21:00:30 GMT

Hi.

I have seen a few posts on Infoblox > Splunk, but not much. Does anyone have infoblox data coming over to splunk successfully? I tried to point Infoblox to my Splunk heavy forwarder via udp but I am not seeing any data yet. Do I need to do via tcp? Is customization needed to be able to start seeing the data over on splunk ?

Thanks for any info,
Paul

Re: How to index Infoblox data in Splunk?

mreynov_splunk — Mon, 10 Aug 2015 18:03:47 GMT

There have been some conf files floating around, but Splunk is about to release a TA-infoblox soon. Let me know if you still need this.

Re: How to index Infoblox data in Splunk?

korstiaan — Tue, 29 Sep 2015 12:58:26 GMT

I'm interested in this TA as well.

Re: How to index Infoblox data in Splunk?

TonyLeeVT — Mon, 29 Feb 2016 21:11:36 GMT

The TA is here: https://splunkbase.splunk.com/app/2934/#/overview
(The TA includes some panels for DNS and one for DHCP.)

Documentation is here: http://docs.splunk.com/Documentation/AddOns/latest/Infoblox/About

Enjoy!

Re: How to index Infoblox data in Splunk?

princemanto2580 — Wed, 21 Dec 2016 09:55:33 GMT

Hi,

I have collected the Infoblox log in CEF format and try to forward it from Universal Forwarder. But still struggling with data on-board.

[monitor:///opt/log/infoblox01/cef.log]
disabled = 0
host = infoblox01
sourcetype = cef.log
index = infoblox

Appreciated if any suggestion or recommendation from Splunker.