Splunk Enterprise

How to get data into Splunk from Aruba Controller?

heathramos
Path Finder

I am trying to forward log files from our Aruba Controller to Splunk but not sure how to configure the data input

I set up a data input of UDP port 514 but what should the source type be?

aruba:syslog?

The Aruba Controller has an option for syslog formatting of either CEF or RFC 3164.

Which format is more Splunk friendly?

 

Labels (2)
Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @heathramos,

You should better use Aruba NetworksAdd-on for Splunk (https://splunkbase.splunk.com/app/4668/#/details )

It expects sourcetype as aruba:syslog. The add-on will rename sourcetypes to correct ones according to message contents.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

heathramos
Path Finder

Thanks

On Splunk, I installed the Aruba Networks Add-on for Splunk, created the udp:514 data input, specified aruba:syslog as source type and placed it in a wifi index.

On Aruba controller, I forwarded logs to Splunk.

The events in Splunk look different than I'm used to. It may just be because its not from a Windows box. Some events have multiple records in it. It made me thing the data wasn't getting parsed correctly.

0 Karma

morganalton
New Member

@heathramos 

 

Do you remember what you you needed to run for the controller to forward the logs to splunk? Ive done everything else on the Splunk side but havent figured out what to run on the WC. Any help would be greatly appreciated!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...