juniper netscreen extraction issues

[sarah89]

hello all,

i installed the netscreen juniper application for exlploring the syslog coming from my juniper

but i doesn't work properly , i have the same dashebord of splunk with the same fields

does anything that i can change to fix this

[MHibbin]

I've not used the Netscreen App myself...

However, having seen other Apps, a common problem could be the use of custom sources; sourcetypes; indexes; etc. You should make a note of how you see the raw data in events (i.e. your populating search), and then you should look at the searches which drive the App's dashboard (you can do this via the manager, as I'm sure there will be use of custom views; saved searches; and even eventtypes).

[tmeader]

Just saw this, sorry I didn't sooner. As you've I'm sure discovered by now... no, the Juniper Netscreen Extractions "AddOn" is just that. AddOns are classified as packages that do smaller things, such as provide just the extractions for a particular sourcetype (in this case Juniper Netscreen syslog output format). There are no special charts or saved searches included in the AddOn.

[sarah89]

i've renamed the sourcetypy, i get the same thing
i just want to know if the netscreen app have a personalized dasheboard or searches already saved

[MHibbin]

If it was me.. I would change the netscreen app, as this does not involve modifying the actual Splunk installation.

[MHibbin]

OK, you could either change the configurations with the Netscreen App (in Splunk) to match your sourcetype ... which would be a lot of work.

Or the easiest method would probably be to rename the sourcetype via the function in Splunk manager (Manager>>Fields>>Sourcetype Renaming). But this could have implications if you add different sources via syslog.

If you are willing to change your set-up, you could look at the answer in this question...

http://splunk-base.splunk.com/answers/34251/udp514-and-source-types

[sarah89]

sourcetype must be a netscreen ? my sourcetype is a syslog