Match IP network source

[pfries54]

I want to add data of a network, for example 192.168.0.0/24.
But when i select TCP/UDP, and i add 192.168.0.* on "Accept connection of" i don't receive log of my network.
But it work when i just indicate UDP port.

It's a problem with my regex ?

[nickhills · Accepted solution]

Splunk is not a network sniffer in itself.

Your option are:

1. Configure Syslog to send data from each host on your network to a TCP/UDP port
   
   https://access.redhat.com/solutions/54363

2. Install a Universal forwarder on each of your hosts
   
   http://docs.splunk.com/Documentation/Forwarder/7.0.1/Forwarder/HowtoforwarddatatoSplunkEnterprise

3. Install and deploy Splunk Stream for network traffic
   
   https://splunkbase.splunk.com/app/1809/

4. many others