Have you installed the other TAs required for the APP and additional source types ? I have never has to specify anything other than CISCO:ASA and the index in the UDP data setup . KL ... View more

Why not try Splunk SA- Splice ? Does a great job https://splunkbase.splunk.com/app/2637/ ... View more

One can do that if your experiencing heavy traffic -depending on the number of devices reporting in - I have never had to go that route though. I will highly recommend using TCP rather than UDP though, as it is connection oriented rather than connection less - makes for eaiser troubleshooting too ... View more

Assume you have run the " Configure Dashboard " ? Try running it for " All time " this will populate your learnt_posix_identities KVStore collection . From there - to test TTY , explicitly enter a POSIX user ( rather than use the wild card ) in the appropriate field on the User TTY dashboard . Works well in my environment ... View more

Hmmm 🙂 Give these a shot ? Not exactly a replacement however there is some decent examples . http://gosplunk.com/category/linuxsecure/ ... View more

No need to create another index . I have set this up many times - outputting all my CISCO devices IPS / ASA /WSA to the same index . They can use the same port however you want to be aware of the amount of traffic flow - which my require you to break out the traffic on various ports e.g. TCP 514 , TCP 515 etc and index to a common index to keep things straight ( my personal preference ) such as index=cisco You should be able to simpley change the source type on your current configuration by editing the data input to reflect cisco:asa BTW - getting the IPS data in can be a challenge due to issues with the python script and SSL - but we can cross that bridge when you get there ... View more

Source type should be set to manual - cisco:asa or cisco_asa ( I forget off hand which one works ) start with cisco:asa You may also want to output the syslogs via TCP as its more reliable and configure a separate index for your Cisco products ..... see link https://answers.splunk.com/answers/174583/cisco-security-suite-add-on-for-cisco-asa-do-i-nee.html ... View more

Pretty sure your source type is incorrect . Check the index to ensure you are receiving events from the ASA ... View more

Try this - I had the same problem when I implemented back in January this year , in your props.conf file append with the following in TA-AWS props.conf ( under the S3 section ) [aws:elb:accesslogs] MAX_TIMESTAMP_LOOKAHEAD = 27 EXTRACT-elb = ^(?P[^ ]+)[^ \n]* (?P[^ ]+)\s+(?P[0-9.]+):(?P\d+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P.[^eventtype])\s+(?P.[^eventtype])\s+(?P\d+)\s+(?P\d+)\s+"(?P.+)"\s+"(?P.+)"\s+(?P[-\w]+)\s*(?P[-\w.]+) EXTRACT-elb = ^(?P[^ ]+)[^ \n]* (?P[^ ]+)\s+(?P[0-9.]+):(?P\d+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P[^\s]+)\s+(?P\d+)\s+(?P\d+)\s+(?P\d+)\s+(?P\d+)\s+"(?P.+)"\s+"(?P.+)"\s+(?P[-\w]+)\s*(?P[-\w.]+) EVAL-rtt = request_processing_time + backend_processing_time + response_processing_time ... View more

Thanks Rodrigo ! Will give it a try . Really appreciate the help . ... View more

They are the 'standard' dashboards offered within the Website Monitoring app - I would like to filter all events when the servers undergo their nightly restarts 0100 - 0120 and 0400 to 0420 sourcetype="web_ping" title="" filter_inoperable | stats count as count *( lists the failures over 24 hrs)** sourcetype="web_ping" title="" | stats max(total_time) as response_time *( lists max response time )** sourcetype="web_ping" title="" | fillnull value=1000 response_code | eval success=case(response_code>=400, 0, timed_out == "True", 0) | fillnull value=1 success | chart count as total, sum(success) as successes | eval availability=round(100(successes/total),2) | fields availability ( lists availability ) Any help would be greatly appreciated ... View more

Rodrigo - not quite sure what you mean ? Can you elaborate ? klaxdal ... View more

try searching for index=main (or what ever index you have established to forward events to ) host="host_name" so from what I am seeing in the screen shots index=main host=ubuntu that should do it - if not use a wildcard on the index= ( index=*) to troubleshoot ... View more

What index are you dropping your data into ? For ease of use direct your syslog traffic to and index named "fgt" and ensure the sourcetype specified in your UDP data inputs is " fgt_log" or the APP wont find the data . ... View more

What is your search parameter ? ... View more

stevieo, Here is the link to the APP https://splunkbase.splunk.com/app/1274/ One also needs to install : https://splunkbase.splunk.com/app/1876/ Can't comment on the Splunk Cloud availability however I run it ( not Splunk Cloud ) on 6.6.0 and it does indeed run fine . KL ... View more

Have you checked your ulimits ? ... View more

Keiffer87 I have installed this app on both WINX64 and Centos - each time I simply edited the .py files to point to the appropriate Splunk dir e.g. on windows the drive with the Splunk install ( C:\ or D:\ etc. ) and run either starter_script.sh or the .bat via the command line . I have only had to run it once . KL ... View more

Try this from search . index=_internal | head 1 | sendemail to="recipient@domain.com" format="html" server=mail-relay.domain.com:465 use_ssl=1 ... View more