Splunk Search

Why is host missing from Search?

New Member

Hi All,

I'm just getting started so this is probably going to be an easy one.

I have Splunk light and have setup PFSense logs to output UDP Port 514 and setup a Splunk Monitor to gather the data (with syslog Source Type), however, when I look in the search the Host is not listed although it is visible in Data Inputs.

I did think that may be it is not visible until the data is detected/collected but I can see with Wire shark that PFsence is sending the data.

What am I doing wrong?

Thanks all

Tags (3)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Could be a few things:
- Did you specify an index? If so when you run the search you will need to specify it as index=whatever to see your data. Alternativly in access_controls you can configure it to search that index by default.
- Is there a firewall on the box? Make sure its not blocking traffic to your port.

All the best

View solution in original post

0 Karma

New Member

It looks like the Windows Domain Firewall hosting Splunk had reset after a windows update/reboot. All working OK now. Good to know that the host will only appear when it is in the data set. Makes sense now as it is the search field pulling direct from the DB and not the configured data inputs

Start Bad, Get good

Thanks guys

0 Karma

Esteemed Legend

There will always be a host field but there will only be a Host field if that is in the data itself.

0 Karma

SplunkTrust
SplunkTrust

Could be a few things:
- Did you specify an index? If so when you run the search you will need to specify it as index=whatever to see your data. Alternativly in access_controls you can configure it to search that index by default.
- Is there a firewall on the box? Make sure its not blocking traffic to your port.

All the best

View solution in original post

0 Karma