What Index Is the Watchguard App looking for?

[jkwinn]

I have installed the Watchguard Firebox app installed as well as the Add-on and I have syslog data coming in from a forwarder with sourcetype=watchguard:firebox:syslog. But the app still isn't poplulating any results. My index is syslog. Should I be using a different index?

[jkwinn]

Here's how I set it up.

1. On the Watchguard, I set it to send syslog to my splunk indexer.
2. In Splunk, I setup an index called wg (index screenshot).
3. In Splunk, I setup a Data Input >> UDP to listen on 22514; Manual source type: watchguard:firebox:syslog. Under More settings I set the hostname and Index to wg and specified the only IP to accept syslog input from (eg. the Watchguard cluster). (Data_Inputs screenshots).

Index Screenshot

Data_Inputs Screenshot

[ansred]

@jkwinn that did the trick and the app is working for me, but I had to set it as Default the index to get it working. Thanks mate!

If you manage to modify the XML app to show more information like map of the world based on the geo information. please share it here to test it if you don't mind.

Cheers

[ansred]

That did the trick. It's working now. Thank you!!

[accesshealth]

I am new to Splunk.
After a few hours research, I change my UDP 514 (Syslog) index from default to madder_index.
Btw, I don't have sourcetype=watchguard:firebox:syslog, so I also change it to sourcetype=syslog.
WatchGuard App is Working for me now, but not WatchGuard add-on.

[ansred]

Hi,

Did you use 514 UDP port in order to get it working?

Can you share some screenshots please from our setup in Splunk?

[happyjack]

I'd like to try this too. Have the data coming in as syslog from the watchguard. Can search/report but no data in Firebox app/add-on. Any tips?

[dcsdne]

Did you ever find a solution to this?

[happyjack]

I'd like to try this too. Have the data coming in as syslog from the watchguard. Can search/report but no data in Firebox app/add-on. Any tips?