Why is Fortinet FortiGate App for Splunk not showing any data after upgrade?

[mike_k]

We recently upgraded Splunk from 7.2.x to 8.1.3. We also upgraded our existing Fortinet apps/add-ons as follows:

• Fortinet Fortigate Add-on for Splunk: from 1.6.0 to 1.6.3
• Fortinet FortiGate App for Splunk: from 1.4 to 1.6.0

When we attempt to view the App dashboards, however they are now not displaying any data on any of the panels.

Searching for terms 'fortigate_traffic', 'fortigate_system', 'fortigate_auth' etc also show no results.

If i go out into the Search & Reporting app and do a basic search on all data coming in from our Fortigate using either "sourcetype=fgt_log" or "index=fgt_logs", I can see that we are ingesting the data from our Fortigate ok, its just not displaying in the app.

Any suggestions appreciated.

[mike_k]

Further to my last post, I have also observed the following:

1) I noticed another post in this forum, where the solution was to Enable Data Model acceleration. However looking in Splunk Web under Data Models, there is no data model called "Fortinet FoS Log".

2) When investigating the Source Types configured on our Splunk Enterprise instance (which is a Standalone server). I can go in under the GUI to Settings>Source Types and can see the Source Type "fgt_log" listed here with the correct App "splunk_TA_fortinet_fortigate". If i click on the Edit action to bring up the details of the Source Type, however it shows the Destination App as "Cisco Networks". Not sure why it should say anything different to the main Source Type listing page. It doesn't appear as though i can change the setting for Destination App in the Edit Source Type window.

[nelis249]

I too am having the same problem. The fortigate apps are installed and are ingesting if I search with index="*" sourcetype=fgt_logs but none of the dashboards provided by the app show anything.

There has to be some type of transform or data source not configured right.