https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12404#M156 <P>As rayfoo suggested, a clearer explanation of what you mean by "limited data" would go a long way toward understanding your problem.</P> <P>This is a fairly old question, so not sure if it's still an issue, but here are some things to try / questions to ask when troubleshooting:</P> <P> <LI></LI></P><P>Are you running the latest version of the Splunk for OSSEC App? There have been some significant changes from 1.0.x to 1.1.x of the app, and there will be several more in 1.2.x.</P> <P><LI></LI></P><P>Does the issue appear with just dashboards, or do you have issues with the saved searches as well? What happens if you search on <CODE>sourcetype=ossec*</CODE> ?</P> <P><LI></LI></P><P>Do the records coming into Splunk have the correct sourcetype? See the Data Inputs section of the README file for the recommended sourcetype values. If they are incorrect, you may need to adjust your Inputs configuration.</P> <P><LI></LI></P><P>The dashboards currently look for specific OSSEC servers, so try running the search:<BR /> <CODE>| inputlookup lookup_ossec_servers</CODE> and make sure your servers are listed. Also, make sure that the default wildcard entry for "All OSSEC Servers" is present. If not, there's a saved search that rebuilds the lookup table, so you might try running that. </P> Wed, 15 Sep 2010 20:45:44 GMT southeringtonp 2010-09-15T20:45:44Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12400#M152 <P>I am abit new to Splunk. I have setup the ossec server with: 6.7.8.9 10002 </P> <P>using the IP of the SPLUNK server. I have successfully installed the Ossec APP, it is not geting any data into Splunk when i look at the dashboard, what other configuration am i missing?</P> Wed, 28 Apr 2010 04:34:18 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12400#M152 azimzores 2010-04-28T04:34:18Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12401#M153 <P>Have you already read the installation text <A href="http://tinyurl.com/2f4uq9a" rel="nofollow">here</A>? </P> Wed, 28 Apr 2010 05:28:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12401#M153 jrodman 2010-04-28T05:28:53Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12402#M154 <P>Yes, seems like limited data is following over.</P> Wed, 28 Apr 2010 06:44:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12402#M154 azimzores 2010-04-28T06:44:09Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12403#M155 <P>Please explain more on what you mean by "limited data"?</P> Tue, 04 May 2010 23:19:53 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12403#M155 rayfoo 2010-05-04T23:19:53Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12404#M156 <P>As rayfoo suggested, a clearer explanation of what you mean by "limited data" would go a long way toward understanding your problem.</P> <P>This is a fairly old question, so not sure if it's still an issue, but here are some things to try / questions to ask when troubleshooting:</P> <P> <LI></LI></P><P>Are you running the latest version of the Splunk for OSSEC App? There have been some significant changes from 1.0.x to 1.1.x of the app, and there will be several more in 1.2.x.</P> <P><LI></LI></P><P>Does the issue appear with just dashboards, or do you have issues with the saved searches as well? What happens if you search on <CODE>sourcetype=ossec*</CODE> ?</P> <P><LI></LI></P><P>Do the records coming into Splunk have the correct sourcetype? See the Data Inputs section of the README file for the recommended sourcetype values. If they are incorrect, you may need to adjust your Inputs configuration.</P> <P><LI></LI></P><P>The dashboards currently look for specific OSSEC servers, so try running the search:<BR /> <CODE>| inputlookup lookup_ossec_servers</CODE> and make sure your servers are listed. Also, make sure that the default wildcard entry for "All OSSEC Servers" is present. If not, there's a saved search that rebuilds the lookup table, so you might try running that. </P> Wed, 15 Sep 2010 20:45:44 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-integrate-OSSEC-with-Splunk/m-p/12404#M156 southeringtonp 2010-09-15T20:45:44Z