how to see sourece/dst IP not host-name in splunk? also see service port number NOT Service name in splunk ?

New Member

hi all : i success retrive checkpoint log into splunk . but i wanna see src/dst IP not hostname .is anyway to config splunk or checkpoint mgmt to see the Real data...any reply is appreciate

0 Karma

New Member

Hello Treyka,

I am very interested in your patch and your improvements. We have tons of checkpoint logs showing up in our Splunk, but we'd like to have the IPs and the service ports instead of their Checkpoint names.

How can I contact you directly ? I don't know how to send you a direct message.

Regards, Jeremy.

0 Karma

Path Finder

jimmli - Splunk's lea_loggrabber app is open-source. I have a patch which enables the behaviour you describe (plus a few other enhancements.) It's working very well for months now, not only in my environment but elsewhere. I've requested Splunk to either grant me commit access to their google code project for lea_loggrabber or at least to review my patch and make it available. Unfortunately no action on their side to date, other than opening the source. Send me a direct message with your email address and I'll send you a package with the patch, readme, plus some support scripts and useful lookups.

Cheers, --Trey

0 Karma

Super Champion

Please elaborate on what your trying to do, or where you are trying to see src/dst information. For example, are you running your own search, or are you using a pre-packaged saved search, or a pre-defined view? Please provided your search string, or the name of the saved search / view. You can use the "edit" link to update your question. (It appears that you may be asking to different questions, if so, you should probably ask two different questions on this site.)

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...