Splunk Enterprise Security

Forwarder not parsing Ossec logs correctly

poiromaniax
Explorer

Hi all,

We have our ossec logs from servers being sent to a forwarder and then the forwarder to indexer. On the forwarder, sourcetype is configured as ossec_alerts

In search results, the source host shows as the forwarder and not the actual server it comes from. The actual server name shows up right next to the date/time but not as a parsed field. EG:

2020/03/20 17:23:00 srv-01 SOURCE=forwarder

Any ideas?

0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...