Splunk Enterprise

How to get data into Splunk from Aruba Controller?

heathramos
Path Finder

I am trying to forward log files from our Aruba Controller to Splunk but not sure how to configure the data input

I set up a data input of UDP port 514 but what should the source type be?

aruba:syslog?

The Aruba Controller has an option for syslog formatting of either CEF or RFC 3164.

Which format is more Splunk friendly?

 

Labels (2)
Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @heathramos,

You should better use Aruba NetworksAdd-on for Splunk (https://splunkbase.splunk.com/app/4668/#/details )

It expects sourcetype as aruba:syslog. The add-on will rename sourcetypes to correct ones according to message contents.

If this reply helps you an upvote is appreciated.
0 Karma

heathramos
Path Finder

Thanks

On Splunk, I installed the Aruba Networks Add-on for Splunk, created the udp:514 data input, specified aruba:syslog as source type and placed it in a wifi index.

On Aruba controller, I forwarded logs to Splunk.

The events in Splunk look different than I'm used to. It may just be because its not from a Windows box. Some events have multiple records in it. It made me thing the data wasn't getting parsed correctly.

0 Karma

morganalton
New Member

@heathramos 

 

Do you remember what you you needed to run for the controller to forward the logs to splunk? Ive done everything else on the Splunk side but havent figured out what to run on the WC. Any help would be greatly appreciated!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...