I can see Sonicwall syslog data under the Search app and data summary, but why is there no data in the Dell Sonicwall Analytics 2.0 app?

[bmccarty12]

Hi All

I am testing a Trial of Splunk Enterprise and doing a little experimenting.

I can see the Sonicwall syslog data in Splunk under "Search and Reporting" and the data summary, so the data is getting into Splunk.

However, there is no data with the Sonicwall app. I created a sonicwall index, but still no luck.

Any pointers ? I'm new at this so maybe something basic.

Thanks !

[skender27]

Problem resolved!

The solution was found in the Windows firewall.
UDP port 2055 was not opened. I created a new rule and also added Splunk to bypass the firewall.
Now I see all the dashboards of dsa app full of data.

Skender

[skender27]

Hi,

I have the same problem... I think the problem is the listening port or csv file to set the correct host for the firewall server.

I look forward to hearing news about this argument!

Hope soon,
Skender

[matthewgao]

You can check if the splunk is listening 2055 or the port you have set to listen first.

[skender27]

Hi,

I get this output when typing:

netstat -an |find "2055"
UDP    0.0.0.0:2055           *:*

Thanks,
Skender

[skender27]

It seems I only get data from the local device where Splunk is installed (the external collector IPfix and not from the firewall).
I can ping the IP of the firewall.

Skender