All Apps and Add-ons

Reporting and Management for OSSEC: OSSEC logs are indexed and can be searched, but why are all dashboards empty?

ozirus
Path Finder

I'm sending OSSEC logs via syslog. All OSSEC logs are indexed and can be found using search, but all OSSEC dashboards are empty. Why is that?

0 Karma
1 Solution

ozirus
Path Finder

In your ossec.conf, please make sure that your log format is default not splunk or any other thing.

...
default
...

View solution in original post

ozirus
Path Finder

In your ossec.conf, please make sure that your log format is default not splunk or any other thing.

...
default
...

southeringtonp
Motivator

This is correct. The "splunk" option in ossec.conf was added by someone else long after the Splunk management app for OSSEC was written, and it does not follow the same logic. Counterintuitive though it may seem, using the "splunk" output option in ossec.conf is not recommended.

The other common source of this problem is if sourcetype is not set correctly for the incoming OSSEC logs.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...