How to use Splunk_TA_fortinet_fortigate for data indexed?

[rayar]

I am configuring Splunk_TA_fortinet_fortigate and no data is indexed 

what might be the issue  ?

the Splunk_TA_fortinet_fortigate is installed on Heavy Forwarder 

input is defined 

[splunk@ilissplfwd09 local]$ cat inputs.conf
[udp://GS-J7-FAZ3K-01-10g.corp.amdocs.com:55555]
connection_host = none
index = test
sourcetype = fortigate_log
[splunk@ilissplfwd09 local]$

from default/props.conf

[fgt_log]
TRANSFORMS-force_sourcetype_fgt = force_sourcetype_fortigate
SHOULD_LINEMERGE = false
EVENT_BREAKER_ENABLE = true

from logs

06-13-2022 12:44:04.870 +0300 INFO Metrics - group=udpin_connections, xxxxxxxxxx:55555, sourcePort=55555.000, _udp_bps=0.000, _udp_kbps=0.000, _udp_avg_thruput=0.000, _udp_kprocessed=0.000, _udp_eps=0.000

• component = Metrics
• date_zone = 180
• event_message = group=udpin_connections, xxxxxxxxxxxxx:55555, sourcePort=55555.000, _udp_bps=0.000, _udp_kbps=0.000,...
• host = xxxxxxx
• index = _internal
• log_level = INFO
• source = /opt/splunk/var/log/splunk/metrics.log
• sourcetype = splunkd
• splunk_server_group = dmc_group_indexer splunk_server_group = dmc_indexerclustergroup_C7623105-1D08-4451-8FC9-DCCE1F03C748

no data is indexed and no error message are generated in internal indexes 

[gcusello]

Hi @rayar,

this TA uses syslogs received by UDP, did you enabled this on your Fortinet?

Did you checked that the route between your Fortinets and HF are open?

Ciao.

Giuseppe

[rayar]

I see the buckets on me HF 

13:06:29.522625 IP xxx.56255 > yyy.55555: UDP, length 667
13:06:29.522630 IP xxx.56255 > yyy.55555: UDP, length 684
13:06:29.522634 IP xxx.56255 > yyy.55555: UDP, length 666
13:06:29.522638 IP xxx.56255 > yyy.55555: UDP, length 666
13:06:29.522643 IP xxx.56255 > yyy.55555: UDP, length 684
13:06:29.522647 IP xxx.56255 > yyy.55555: UDP, length 682
13:06:29.523103 IP xxx.56255 > yyy.55555: UDP, length 679
13:06:29.523130 IP xxx.56255 > yyy.55555: UDP, length 648
13:06:29.523137 IP xxx.56255 > yyy.55555: UDP, length 683
13:06:29.523141 IP xxx.56255 > yyy.55555: UDP, length 666
13:06:29.523146 IP xxx.56255 > yyy.55555: UDP, length 665
13:06:29.523152 IP xxx.56255 > yyy.55555: UDP, length 684
13:06:29.523157 IP xxx.56255 > yyy.55555: UDP, length 65312802 packet

[gcusello]

Hi @rayar,

where did you installed the TA?

It should be on the Splunk instanes as described at https://splunkbase.splunk.com/app/2846/#/details especially on HF

Ciao.

Giuseppe

[rayar]

I have installed and configured on the heavy forwarder 

[gcusello]

Hi @rayar,

did you inserted "sourcetype = fortigate_log" in inputs.conf or it's by default in the TA?

Ciao.

Giuseppe

[rayar]

it was defined as a sourcetype in the TA , I configured my input

[gcusello]

Hi @rayar,

try to use in the input

sourcetype = fgt_log

Ciao.

Giuseppe

[rayar]

looks like the same 

I see in metrics all values are 0.000

_udp_bps=0.000, _udp_kbps=0.000, _udp_avg_thruput=0.000, _udp_kprocessed=0.000, _udp_eps=0.000

does it mean it gets an empty values ?

06-13-2022 13:53:43.168 +0300 INFO Metrics - group=udpin_connections, *:55555, sourcePort=55555.000, _udp_bps=0.000, _udp_kbps=0.000, _udp_avg_thruput=0.000, _udp_kprocessed=0.000, _udp_eps=0.000

• component = Metrics
• date_zone = 180
• event_message = group=udpin_connections, *:55555, sourcePort=55555.000, _udp_bps=0.000, _udp_kbps=0.000, _udp_avg_th...
• host = yyyyy
• index = _internal
• log_level = INFO

[gcusello]

Hi @rayar,

did you checked if you have fortiner logs in the choosen index?

Ciao.

Giuseppe

[rayar]

there is no data under the index 

I also tested a manual csv file  upload from the HF to this index and it was successfully indexed  

[rayar · Accepted solution]

we found the issue 

there was firewall enabled on the Linux (HF) server 

[gcusello]

Hi @rayar,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉