RWI

[z_kat]

I am new to splunk and need some guidance. I have install RWI and the add-in's required. 

I would like to pull the Active VPN Sessions and number of VPN logins  from my SonicWall firewall, but I'm not sure where to start so that I can see this information in the RWI Dashboard.  

Regards,

Z_Kat

[richgalloway]

Are you Splunking your SonicWall data?  If not, that's the best place to start.

If you do have the data indexed then you need to modify the dashboard to search for your data instead of whatever it searches by default.

[z_kat]

I am not currently splunking that data.   I am assuming that I would just send it to splunk via syslog.  Is that a correct assumption or is there a better method? 

[z_kat]

I've set up the firewall to send syslog data to splunk.  I've set up splunk to accept tcp:514 source type syslog and index = vpn 

I am not receiving any data. What am I missing? 

[z_kat]

I found the syslog installation and set it up under files and directories and I can now see the syslog data coming in from the firewall wall. 

Now my question is how do I get into RWI.  the rw_vpn_indexes is set to index VPN.  I probably need to change the nodename but I'm not sure what to change it to or where to change it.

| tstats dc(All_Sessions.user) from datamodel=Network_Sessions where `rw_vpn_indexes` nodename=All_Sessions.VPN

I could also be going completely down the wrong rabbit hole. 

I've been reading the documentation but nothing has hit home yet. 

Thanks,

Z