I loaded the app "Splunk for Juniper SRX". I'm running Splunk 4.3. I don't seen any data being popultaed into the app.
I can see the syslog data within the native seach app. When I click on the Juniper apps I get the following error.
The following messages were returned by the search subsystem:
DEBUG: base lispy: [ AND sourcetype::srx_traffic ]
DEBUG: search context: user="mpegan", app="SplunkforJuniperSRX", bs-pathname="/opt/splunk/etc"
I'm very new to Splunk and don't know how to troubleshoot this. Do I need to configure the sourcetype srx_traffic?
Any help is greatly appreciated. Thanks
the sourcetype needs to be srx_log
There is a README in the apps folder SPLUNK_HOME/etc/apps/SplunkforJuniperSRX/
it seems that I cannot get any data, im using splunk port 514 for udp
the sourcetype needs to be srx_log
There is a README in the apps folder SPLUNK_HOME/etc/apps/SplunkforJuniperSRX/
oh man!
That did it. Thanks so much. I was so looking forward to this app.
I am glad it did! Please accept my answer for those who have same issue to know this is the answer.Thanks