Getting Data In

How to index Infoblox data in Splunk?



I have seen a few posts on Infoblox > Splunk, but not much. Does anyone have infoblox data coming over to splunk successfully? I tried to point Infoblox to my Splunk heavy forwarder via udp but I am not seeing any data yet. Do I need to do via tcp? Is customization needed to be able to start seeing the data over on splunk ?

Thanks for any info,

Tags (4)
0 Karma



I have collected the Infoblox log in CEF format and try to forward it from Universal Forwarder. But still struggling with data on-board.

disabled = 0
host = infoblox01
sourcetype = cef.log
index = infoblox

Appreciated if any suggestion or recommendation from Splunker.

0 Karma


The TA is here:
(The TA includes some panels for DNS and one for DHCP.)

Documentation is here:


Splunk Employee
Splunk Employee

There have been some conf files floating around, but Splunk is about to release a TA-infoblox soon. Let me know if you still need this.

0 Karma


I'm interested in this TA as well.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...