topic infblox DHCP src and dest flipping in Getting Data In

infblox DHCP src and dest flipping

Splunk_rocks — Thu, 07 Feb 2019 19:03:23 GMT

Hello Splunkers,

Has any one worked on infoblox DHCP and DNS data sourctypes , i see the src , srcport, dstport, dst fields are flipping with events information. Any one had made any adjustments in TA side ? Any suggestions.

Re: infblox DHCP src and dest flipping

muralikoppula — Tue, 29 Sep 2020 23:06:52 GMT

What is the sourcetype you used in syslog monitor inputs , it should be "infoblox:file"

You need to install Splunk_TA_infoblox on your HF/Indexers, hope this will fix.

Re: infblox DHCP src and dest flipping

Splunk_rocks — Tue, 12 Feb 2019 15:13:43 GMT

Hey im beyond that source type level, InfoBlox have predefined 2 sourcetypes infoblox:dhs and DNS,
DNS had issues flip when you getting response and request logs.

Re: infblox DHCP src and dest flipping

Splunk_rocks — Tue, 12 Feb 2019 15:25:59 GMT

Here splunk answer https://answers.splunk.com/answers/373542/why-does-the-splunk-add-on-for-infoblox-not-always.html