Home Monitor: How to configure the app with a Buffalo DDWRT router?

[ls3]

How do I configure the Home Monitor app with a Buffalo DDWRT router?

[amiracle]

Have you seen the latest blog post showing you how to setup DD-WRT for the Home Monitor app : http://amiracle19.blogspot.com/2016/02/adding-dd-wrt-sourcetype.html

Here is the props.conf entry that you'll need to make :

[dd-wrt]
pulldown_type = 1
EXTRACT-action = (?i) .*?: (?P<action>\w+)(?= )
FIELDALIAS-dst = DST as dest_ip
FIELDALIAS-dpt = DPT as dest_port
FIELDALIAS-proto = PROTO as protocol
FIELDALIAS-SPT = SPT as src_port
FIELDALIAS-SRC = SRC as src_ip
EVAL-direction = if(match(OUT,"eth*"), "out", "in")
LOOKUP-action_lookup = action_lookup action OUTPUT action2
LOOKUP-rdns = dnsLookup ip AS dest_ip OUTPUTNEW host as rdns_host

I hope that fixes your issue.

-Kam

[amiracle]

The first thing I would do is get the data from the router to your Splunk server via syslog (UDP 514). Once you've accomplished that, then you can use the [netgear] source type, which I believe is closest to the way DDWRT logs the events, to start populating your data. If you want, you can post a sample of the events coming from your router to this post. I can then help you 'source type' that data.