how to see sourece/dst IP not host-name in splunk? also see service port number NOT Service name in splunk ?

[jimmli]

hi all : i success retrive checkpoint log into splunk . but i wanna see src/dst IP not hostname .is anyway to config splunk or checkpoint mgmt to see the Real data...any reply is appreciate

[SecurityAccorCo]

Hello Treyka,

I am very interested in your patch and your improvements. We have tons of checkpoint logs showing up in our Splunk, but we'd like to have the IPs and the service ports instead of their Checkpoint names.

How can I contact you directly ? I don't know how to send you a direct message.

Regards, Jeremy.

[treyka]

jimmli - Splunk's lea_loggrabber app is open-source. I have a patch which enables the behaviour you describe (plus a few other enhancements.) It's working very well for months now, not only in my environment but elsewhere. I've requested Splunk to either grant me commit access to their google code project for lea_loggrabber or at least to review my patch and make it available. Unfortunately no action on their side to date, other than opening the source. Send me a direct message with your email address and I'll send you a package with the patch, readme, plus some support scripts and useful lookups.

Cheers, --Trey

[Lowell]

Please elaborate on what your trying to do, or where you are trying to see src/dst information. For example, are you running your own search, or are you using a pre-packaged saved search, or a pre-defined view? Please provided your search string, or the name of the saved search / view. You can use the "edit" link to update your question. (It appears that you may be asking to different questions, if so, you should probably ask two different questions on this site.)