All Apps and Add-ons

juniper netscreen extraction issues

Path Finder

hello all,

i installed the netscreen juniper application for exlploring the syslog coming from my juniper

but i doesn't work properly , i have the same dashebord of splunk with the same fields

does anything that i can change to fix this

0 Karma

Influencer

I've not used the Netscreen App myself...

However, having seen other Apps, a common problem could be the use of custom sources; sourcetypes; indexes; etc. You should make a note of how you see the raw data in events (i.e. your populating search), and then you should look at the searches which drive the App's dashboard (you can do this via the manager, as I'm sure there will be use of custom views; saved searches; and even eventtypes).

0 Karma

Contributor

Just saw this, sorry I didn't sooner. As you've I'm sure discovered by now... no, the Juniper Netscreen Extractions "AddOn" is just that. AddOns are classified as packages that do smaller things, such as provide just the extractions for a particular sourcetype (in this case Juniper Netscreen syslog output format). There are no special charts or saved searches included in the AddOn.

0 Karma

Path Finder

i've renamed the sourcetypy, i get the same thing
i just want to know if the netscreen app have a personalized dasheboard or searches already saved

0 Karma

Influencer

If it was me.. I would change the netscreen app, as this does not involve modifying the actual Splunk installation.

0 Karma

Influencer

OK, you could either change the configurations with the Netscreen App (in Splunk) to match your sourcetype ... which would be a lot of work.

Or the easiest method would probably be to rename the sourcetype via the function in Splunk manager (Manager>>Fields>>Sourcetype Renaming). But this could have implications if you add different sources via syslog.

If you are willing to change your set-up, you could look at the answer in this question...

http://splunk-base.splunk.com/answers/34251/udp514-and-source-types

0 Karma

Path Finder

sourcetype must be a netscreen ? my sourcetype is a syslog

0 Karma