Why is host missing from Search?

[zuma01]

Hi All,

I'm just getting started so this is probably going to be an easy one.

I have Splunk light and have setup PFSense logs to output UDP Port 514 and setup a Splunk Monitor to gather the data (with syslog Source Type), however, when I look in the search the Host is not listed although it is visible in Data Inputs.

I did think that may be it is not visible until the data is detected/collected but I can see with Wire shark that PFsence is sending the data.

What am I doing wrong?

Thanks all

[zuma01]

It looks like the Windows Domain Firewall hosting Splunk had reset after a windows update/reboot. All working OK now. Good to know that the host will only appear when it is in the data set. Makes sense now as it is the search field pulling direct from the DB and not the configured data inputs

Start Bad, Get good

Thanks guys

[woodcock]

There will always be a host field but there will only be a Host field if that is in the data itself.

[chrisyounger · Accepted solution]

Could be a few things:
- Did you specify an index? If so when you run the search you will need to specify it as index=whatever to see your data. Alternativly in access_controls you can configure it to search that index by default.
- Is there a firewall on the box? Make sure its not blocking traffic to your port.

All the best