All Apps and Add-ons

Adding xauthuser to datamodel

Path Finder

I tried to add the xauthuser field to the data model ftnt_fos and after that I get no results any more. Did I break it?

The xauthuser field carries the username that connected to the firewall using an ipsec tunnel, it's a critical field for the vpn dashboard.

0 Karma

Path Finder

In the Splunk web ui I went to Settings/Datamodels, then opened the "Fortinet FOS Log" datamodel:

  • I disabled acceleration otherwise it does not allow me to edit the datamodel
  • In the "Firewall Logs" item I added a new extracted field named xauthuser with type string.
  • Enabled acceleration again.

Now when I go to any Fortigate pre-built dashboard I get "No results".

0 Karma

Contributor

what's the datamodel acceleration progress?

0 Karma

Path Finder

93%, now the dashboards are working. I think I just didn't wait enough, thank you for your help.

0 Karma

Contributor

what file are you changing? the datamodel should be defined in SplunkAppForFortinet/default/data/models/ftnt_fos.json
what are your changes? please paste it here.
which dashboard query on vpn are you adding/customizing?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!