All Apps and Add-ons

Support for Clearpass Insight logs

ftdrhr4378
New Member

We're attempting to get Clearpass Insight logs into Splunk. We've had the Aruba ClearPass App for Splunk Enterprise app configured and in use for RADIUS logs, etc. for some time.

Current software versions are:
Splunk - Splunk Cloud 7.0.8.5
ClearPass Policy Manager 6.7.9
App - Aruba ClearPass App for Splunk Enterprise 2.0

We have configured our logging outputs per the "Supporting XML file for configuring ClearPass Syslog filters" http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default....

I cannot see any reference in the above XML to Insight logs. In theory these would be 'clearpass_insight_logs'

Is there any support for Insight logs within the App/TA
How should the ClearPass Syslog filters be configured to support the above?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...