What is the difference between the Splunk for Fortinet FortiOS 5 and Splunk for Fortigate apps and how do I connect my Fortigate machine?

[gerisplunk]

Hello,

Can somebody please help explain the difference between the Splunk for Fortinet FortiOS 5 and Splunk for Fortigate apps?

I have a fortinet v.5.0 ...enabled log forwarding to the Splunk server. Logs are displaying in the Search & Reporting app correctly ...but how can I connect FortiOS 5 app with my fortigate? I am totally new to Splunk and maybe it's not clear what I'm searching, but is it possible to directly connect via the FortiOS 5 or Fortigate app to my the Fortigate Machine???

Thank you very much in advance

[dfigurello]

Hi gerisplunk,

Splunk for fortinet just support fortios version 4 and this app is incompatible with fortios 5.
In "Splunk for Fortinet FortiOS 5", you have a new extractions based on the FortiOS 5 new log format.

Installation Instructions:

The Splunk for FortiOS 5 can be installed by either the Splunk app setup screen, or by manually installing and configuring the app.
Once the app is installed, you need to configure the FortiGate firewall to send the logs to Splunk (udp/513 port). Below is shown the required commands to configure the firewall to send the logs (at date, FortiOS 5 do not support syslog configuration in the Web UI):

config log syslogd setting

set status enable

set server splunk_ip

set port 513

end

I love create my own dashboards and then I create my apps, because splunk is esay. Enjoy it.

Just check this ebook:
http://www.splunk.com/goto/book

Cheers!

[jsconner]

How do I turn off logging from the fortigate if I decide to stop using splunk?