https://community.splunk.com/t5/Getting-Data-In/Trouble-with-TA-Juniper/m-p/33120#M5916 <P>I have a Juniper firewall that forwards syslog/udp:514 data from a forwarder to an indexer in one of my 2 production data centers (DC1 and DC2)</P> <P>I have installed the TA-Juniper app on each of the indexers thru a deployment server and they are setup identically.</P> <P>However the app is working correctly in DC1 and <STRONG>NOT</STRONG> in DC2.</P> <P>The app exists in the same location and there are no networking issues between the forwarder/indexer or search head.</P> <P>On the indexer that is <STRONG>NOT</STRONG> working I've run:</P> <PRE><CODE>./splunk cmd btool transforms list --debug | grep TA-juniper | more./splunk cmd btool transforms list --debug | grep TA-juniper | more </CODE></PRE> <P>and confirmed that the transforms are in place and the app is enabled.</P> <P>Data from the forwarder in DC2 is being received at the indexer but is defaulting to the syslog sourcetype. It's like the indexer is completely ignoring the TA-juniper app?</P> <P>I've restarted the indexer a couple of times with no change in behavior.</P> Mon, 12 Dec 2011 16:11:15 GMT Kate_Lawrence-G 2011-12-12T16:11:15Z https://community.splunk.com/t5/Getting-Data-In/Trouble-with-TA-Juniper/m-p/33120#M5916 <P>I have a Juniper firewall that forwards syslog/udp:514 data from a forwarder to an indexer in one of my 2 production data centers (DC1 and DC2)</P> <P>I have installed the TA-Juniper app on each of the indexers thru a deployment server and they are setup identically.</P> <P>However the app is working correctly in DC1 and <STRONG>NOT</STRONG> in DC2.</P> <P>The app exists in the same location and there are no networking issues between the forwarder/indexer or search head.</P> <P>On the indexer that is <STRONG>NOT</STRONG> working I've run:</P> <PRE><CODE>./splunk cmd btool transforms list --debug | grep TA-juniper | more./splunk cmd btool transforms list --debug | grep TA-juniper | more </CODE></PRE> <P>and confirmed that the transforms are in place and the app is enabled.</P> <P>Data from the forwarder in DC2 is being received at the indexer but is defaulting to the syslog sourcetype. It's like the indexer is completely ignoring the TA-juniper app?</P> <P>I've restarted the indexer a couple of times with no change in behavior.</P> Mon, 12 Dec 2011 16:11:15 GMT https://community.splunk.com/t5/Getting-Data-In/Trouble-with-TA-Juniper/m-p/33120#M5916 Kate_Lawrence-G 2011-12-12T16:11:15Z https://community.splunk.com/t5/Getting-Data-In/Trouble-with-TA-Juniper/m-p/33121#M5917 <P>Kate,</P> <P>When you say "I have a Juniper firewall that forwards syslog/udp:514 data from a forwarder", are you using a full forwarder? If so, then you will need to deploy TA-Juniper at the forwarder. I recognize that this would not explain why one indexer is working and the other is not but may be contributing to the problem.</P> <P>If this is not the case, could you please open a ticket with support and provide diags? This will make it much easier for Splunk to get a handle on the root cause.</P> Mon, 12 Dec 2011 21:15:30 GMT https://community.splunk.com/t5/Getting-Data-In/Trouble-with-TA-Juniper/m-p/33121#M5917 LukeMurphey 2011-12-12T21:15:30Z