https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35262#M7721 <P>Did you look to see what that 500 internal server was in your httpd error_log ?</P> Wed, 22 May 2013 09:57:48 GMT macdock 2013-05-22T09:57:48Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35257#M7716 <P>I have splunk using the local mod sec audit folder ( containing concurrent logs ) and I am able to search through the entries alright, but I am not seeing results or charts for any of the predefined stuff. I am using ModSec 2.7</P> <P>Also there are literally thousands of sources ( and growing ) is this a bad thing?</P> Wed, 15 May 2013 19:13:51 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35257#M7716 macdock 2013-05-15T19:13:51Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35258#M7717 <P>how were you able to get splunk to use the concurrent logs?</P> Tue, 21 May 2013 14:18:13 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35258#M7717 avigs 2013-05-21T14:18:13Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35259#M7718 <P>I just specified the data folder as the data source, the ms app did the rest. I am using waf-fle now though, works much better. <A href="http://www.waf-fle.org">http://www.waf-fle.org</A></P> Tue, 21 May 2013 18:29:22 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35259#M7718 macdock 2013-05-21T18:29:22Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35260#M7719 <P>splunk will only let me choose a file, not a directory for the data source.<BR /> I've tried waf-fle but I get a 500 error when trying to send the log messages with mlogc</P> Wed, 22 May 2013 07:18:33 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35260#M7719 avigs 2013-05-22T07:18:33Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35261#M7720 <P>Did you look to see what that 500 internal server was in your httpd error_log ?</P> Wed, 22 May 2013 09:57:26 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35261#M7720 macdock 2013-05-22T09:57:26Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35262#M7721 <P>Did you look to see what that 500 internal server was in your httpd error_log ?</P> Wed, 22 May 2013 09:57:48 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35262#M7721 macdock 2013-05-22T09:57:48Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35263#M7722 <P>there's no error being logged.</P> Wed, 22 May 2013 11:51:38 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35263#M7722 avigs 2013-05-22T11:51:38Z https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35264#M7723 <P>i figured out the issue and was able to use waf-fle. Why do you think it's better? I can't drill down the reports to find all the paths requested. It would seem splunk has more sophisticated filters</P> Thu, 23 May 2013 08:46:46 GMT https://community.splunk.com/t5/Splunk-Search/Modsecurity-charts-not-working/m-p/35264#M7723 avigs 2013-05-23T08:46:46Z