All Apps and Add-ons
Highlighted

Support for Clearpass Insight logs

New Member

We're attempting to get Clearpass Insight logs into Splunk. We've had the Aruba ClearPass App for Splunk Enterprise app configured and in use for RADIUS logs, etc. for some time.

Current software versions are:
Splunk - Splunk Cloud 7.0.8.5
ClearPass Policy Manager 6.7.9
App - Aruba ClearPass App for Splunk Enterprise 2.0

We have configured our logging outputs per the "Supporting XML file for configuring ClearPass Syslog filters" http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default....

I cannot see any reference in the above XML to Insight logs. In theory these would be 'clearpassinsightlogs'

Is there any support for Insight logs within the App/TA
How should the ClearPass Syslog filters be configured to support the above?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.