Please use this link (you should be authenticated first) http://www.splunk.com/en_us/download/splunk-enterprise.html Regards, Ahmed ... View more

You can create monitoring stanza in inputs.conf to process forwarder logs (they should have different naming than local files, for example ending with .gz) as per the following: [monitor:///tmp/*.gz] index = IndexB sourcetype = fwd_logs This stanza for linux system please modify it for windows. Regards, Ahmed ... View more

Hello, I've installed the app and find from dashboard that some reports are using the eventtype "cisco-security-events" as per the following search query (I got it by clicking isnpect icon under any report from the dashboard): search eventtype=cisco-security-events dest_ip!="255.255.255.255" dest_ip!="0.0.0.0" src_ip="*" | top src_ip So you should assign eventtype to all the logs inside network index, application already created many event types as per the following url from web interface: http://x.x.x.x:8000/en-US/manager/Splunk_CiscoSecuritySuite/saved/eventtypes I located the files under /opt/splunk/etc/ that contains the eventtypes and found 2 files as per the following: [root@node1]# cat /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/eventtypes.conf [cisco-security-events] search = sourcetype="cisco:*" [root@node1]# cat /opt/splunk/etc/apps/Splunk_TA_cisco-asa/default/eventtypes.conf [cisco_authentication] search = sourcetype="cisco:*" action="success" OR action="failure" #tags = authentication [cisco_connection] search = sourcetype="cisco:*" (action="allowed" OR action="blocked" OR action="unknown" OR action="teardown") #tags = network communicate [cisco_intrusion] search = (sourcetype="cisco:asa" OR sourcetype="cisco:pix") message_id="4000*" #tags = attack ids [cisco_malware] search = sourcetype="cisco:asa" vendor_category="malware" #tags = malware operations [cisco_vpn] search = sourcetype="cisco:*" (vendor_class="vpn" OR vendor_definition="*vpn*") #tags = network vpn [cisco_vpn_start] search = sourcetype="cisco:*" (message_id=716001 OR message_id=722022 OR message_id=713119 OR message_is=713049) #tags = start session [cisco_vpn_end] search = sourcetype="cisco:*" (message_id=716002 OR message_id=722023 OR message_id=113019) #tags = end session [cisco_asa_configuration_change] search = sourcetype="cisco:asa*" (message_id=111010 OR change_class=*) #tags = change so you should edit the above 2 files with your sourcetype of the logs under network index, I'll assume that your sourcetype is "syslog" so you should edit the files as per the following: search = sourcetype="cisco:*" should be changed to search = sourcetype="syslog" Then restart searchhead. Regards, Ahmed ... View more

The following configuration is working fine with me: I generated CA cert and indexer and forwarders certs as per the following: CA cert: mkdir -p /opt/splunk/etc/certs export OPENSSL_CONF=/opt/splunk/openssl/openssl.cnf /opt/splunk/bin/genRootCA.sh -d /opt/splunk/etc/certs/ indexer cert: /opt/splunk/bin/splunk createssl server-cert -d /opt/splunk/etc/certs/ -n indexer -c indexer -p forwarder cert: /opt/splunk/bin/splunk createssl server-cert -d /opt/splunk/etc/certs/ -n forwarder -p on indexer: [splunktcp-ssl://9997] connection_host = none [SSL] rootCA = /opt/splunk/etc/system/local/certs/cacert.pem serverCert = /opt/splunk/etc/system/local/certs/indexer.pem password = P@ssw0rd requireClientCert = false on forwarder: [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = indexer1:9997, indexer2:9997 sslRootCAPath = /opt/splunkforwarder/etc/apps/search/local/certs/cacert.pem sslCertPath = /opt/splunkforwarder/etc/apps/search/local/certs/forwarder.pem sslPassword = P@ssw0rd sslCommonNameToCheck = indexer sslVerifyServerCert = true Regards, Ahmed Elakwah ... View more

The following configuration worked fine with me, inputs.conf [monitor://$SPLUNK_HOME/var/log/splunk/audit.log*] _SYSLOG_ROUTING = syslog-out1 outputs.conf [syslog] defaultGroup = syslog-out1 [syslog:syslog-out1] disabled = false server = x.x.x.x:514 type = tcp Regards, Ahmed Elakwah ... View more