TA-Tomato (DD-WRT compatible): Why am I unable to see data for Asuswrt-Merlin WRT Firmware?

[khandpi]

Hey Guys

So I have installed this app in Splunk in the docker. I have a TCP port 1514 listening for data and from my Asuswrt Router, I have logs sent to the SplunkIP:1514 UDP and shows in search for index="tomato"

On the router I also

But the app is still not showing any data. I edited the first panel (System Monitoring) source and changed the IP to 192.168.1.50 (instead of 1.1) as that is the router IP

What else am I missing? New to Splunk

[WollyCGN]

Good point, but there is no section 'macro' in settings!

[MuS]

Hi khandpi,

you might check this (from the install instruction of the app):

***Please onboard your data as sourcetype=tomato. This will sub-sourcetype to various components with their own logic for extractions, event types, dashboards, etc.

This app also assumes your data will exist in index=tomato. If it does not, you will need to update 2 variables.
Settings > macros > tomato_index (index=tomato)
Settings > eventtypes > tomato (index=tomato)

cheers, MuS