How to integrate OSSEC with Splunk.

[azimzores]

I am abit new to Splunk. I have setup the ossec server with: 6.7.8.9 10002

using the IP of the SPLUNK server. I have successfully installed the Ossec APP, it is not geting any data into Splunk when i look at the dashboard, what other configuration am i missing?

[southeringtonp]

As rayfoo suggested, a clearer explanation of what you mean by "limited data" would go a long way toward understanding your problem.

This is a fairly old question, so not sure if it's still an issue, but here are some things to try / questions to ask when troubleshooting:

Are you running the latest version of the Splunk for OSSEC App? There have been some significant changes from 1.0.x to 1.1.x of the app, and there will be several more in 1.2.x.

Does the issue appear with just dashboards, or do you have issues with the saved searches as well? What happens if you search on sourcetype=ossec* ?

Do the records coming into Splunk have the correct sourcetype? See the Data Inputs section of the README file for the recommended sourcetype values. If they are incorrect, you may need to adjust your Inputs configuration.

The dashboards currently look for specific OSSEC servers, so try running the search:
| inputlookup lookup_ossec_servers and make sure your servers are listed. Also, make sure that the default wildcard entry for "All OSSEC Servers" is present. If not, there's a saved search that rebuilds the lookup table, so you might try running that.

[jrodman]

Have you already read the installation text here?

[rayfoo]

Please explain more on what you mean by "limited data"?

[azimzores]

Yes, seems like limited data is following over.