All Apps and Add-ons

Reporting and Management for OSSEC: OSSEC logs are indexed and can be searched, but why are all dashboards empty?

ozirus
Path Finder

I'm sending OSSEC logs via syslog. All OSSEC logs are indexed and can be found using search, but all OSSEC dashboards are empty. Why is that?

0 Karma
1 Solution

ozirus
Path Finder

In your ossec.conf, please make sure that your log format is default not splunk or any other thing.

...
default
...

View solution in original post

ozirus
Path Finder

In your ossec.conf, please make sure that your log format is default not splunk or any other thing.

...
default
...

southeringtonp
Motivator

This is correct. The "splunk" option in ossec.conf was added by someone else long after the Splunk management app for OSSEC was written, and it does not follow the same logic. Counterintuitive though it may seem, using the "splunk" output option in ossec.conf is not recommended.

The other common source of this problem is if sourcetype is not set correctly for the incoming OSSEC logs.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...