Splunk Search

Why is host missing from Search?

zuma01
New Member

Hi All,

I'm just getting started so this is probably going to be an easy one.

I have Splunk light and have setup PFSense logs to output UDP Port 514 and setup a Splunk Monitor to gather the data (with syslog Source Type), however, when I look in the search the Host is not listed although it is visible in Data Inputs.

I did think that may be it is not visible until the data is detected/collected but I can see with Wire shark that PFsence is sending the data.

What am I doing wrong?

Thanks all

Tags (3)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Could be a few things:
- Did you specify an index? If so when you run the search you will need to specify it as index=whatever to see your data. Alternativly in access_controls you can configure it to search that index by default.
- Is there a firewall on the box? Make sure its not blocking traffic to your port.

All the best

View solution in original post

0 Karma

zuma01
New Member

It looks like the Windows Domain Firewall hosting Splunk had reset after a windows update/reboot. All working OK now. Good to know that the host will only appear when it is in the data set. Makes sense now as it is the search field pulling direct from the DB and not the configured data inputs

Start Bad, Get good

Thanks guys

0 Karma

woodcock
Esteemed Legend

There will always be a host field but there will only be a Host field if that is in the data itself.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Could be a few things:
- Did you specify an index? If so when you run the search you will need to specify it as index=whatever to see your data. Alternativly in access_controls you can configure it to search that index by default.
- Is there a firewall on the box? Make sure its not blocking traffic to your port.

All the best

0 Karma
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...