How to get data into Splunk from Aruba Controller?

[heathramos]

I am trying to forward log files from our Aruba Controller to Splunk but not sure how to configure the data input

I set up a data input of UDP port 514 but what should the source type be?

aruba:syslog?

The Aruba Controller has an option for syslog formatting of either CEF or RFC 3164.

Which format is more Splunk friendly?

[scelikok]

Hi @heathramos,

You should better use Aruba NetworksAdd-on for Splunk (https://splunkbase.splunk.com/app/4668/#/details )

It expects sourcetype as aruba:syslog. The add-on will rename sourcetypes to correct ones according to message contents.

[heathramos]

Thanks

On Splunk, I installed the Aruba Networks Add-on for Splunk, created the udp:514 data input, specified aruba:syslog as source type and placed it in a wifi index.

On Aruba controller, I forwarded logs to Splunk.

The events in Splunk look different than I'm used to. It may just be because its not from a Windows box. Some events have multiple records in it. It made me thing the data wasn't getting parsed correctly.

[morganalton]

@heathramos 

Do you remember what you you needed to run for the controller to forward the logs to splunk? Ive done everything else on the Splunk side but havent figured out what to run on the WC. Any help would be greatly appreciated!