Help with Juniper SRX App - sourcetype=srx_traffic

[mpegan]

I loaded the app "Splunk for Juniper SRX". I'm running Splunk 4.3. I don't seen any data being popultaed into the app.

I can see the syslog data within the native seach app. When I click on the Juniper apps I get the following error.

The following messages were returned by the search subsystem:
DEBUG: base lispy: [ AND sourcetype::srx_traffic ]
DEBUG: search context: user="mpegan", app="SplunkforJuniperSRX", bs-pathname="/opt/splunk/etc"

I'm very new to Splunk and don't know how to troubleshoot this. Do I need to configure the sourcetype srx_traffic?

Any help is greatly appreciated. Thanks

[pollo123]

it seems that I cannot get any data, im using splunk port 514 for udp

[MarioM · Accepted solution]

the sourcetype needs to be srx_log

There is a README in the apps folder SPLUNK_HOME/etc/apps/SplunkforJuniperSRX/

[mpegan]

oh man!

That did it. Thanks so much. I was so looking forward to this app.

[MarioM]

I am glad it did! Please accept my answer for those who have same issue to know this is the answer.Thanks