All Apps and Add-ons

Support for Clearpass Insight logs

ftdrhr4378
New Member

We're attempting to get Clearpass Insight logs into Splunk. We've had the Aruba ClearPass App for Splunk Enterprise app configured and in use for RADIUS logs, etc. for some time.

Current software versions are:
Splunk - Splunk Cloud 7.0.8.5
ClearPass Policy Manager 6.7.9
App - Aruba ClearPass App for Splunk Enterprise 2.0

We have configured our logging outputs per the "Supporting XML file for configuring ClearPass Syslog filters" http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default....

I cannot see any reference in the above XML to Insight logs. In theory these would be 'clearpass_insight_logs'

Is there any support for Insight logs within the App/TA
How should the ClearPass Syslog filters be configured to support the above?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...