cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
j_stock
Explorer
Member since: ‎08-11-2019
‎08-31-2021
Community Statistics
Posts 6
Solutions 2
Karma Given 0
Karma Received 1
Member Since ‎08-11-2019
Activity Feed
View All

FreeBSD 12+ Universal Forwarder

by in Getting Data In
‎08-31-2021 05:16 PM
‎08-31-2021 05:16 PM
Hi all, I've noticed that the last Universal Forwarder for FreeBSD available is for 11.3 but FreeBSD is now up to 13.0. I know that FreeBSD is a bit of a dying space except in appliances where tools exist to manage log output as syslog on those appliances, ie pfsense, opnsense, Truenas, etc.  Can I reasonably assume then that there is not likely to be any new versions of the Universal Forwarder to support later versions of FreeBSD for this reason, ie FreeBSD is only showing up in appliances that can do syslog forwarding? ... View more
Labels

Re: TA-pfsense logs start then... stop

by in All Apps and Add-ons
‎01-13-2020 01:13 AM
‎01-13-2020 01:13 AM
Okay, the answer is this: https://answers.splunk.com/answers/626816/pfsense-event-date-time-wrong.html ... View more

TA-pfsense logs start then... stop

by in All Apps and Add-ons
‎01-12-2020 01:27 AM
‎01-12-2020 01:27 AM
I have a weird issue with the TA-pfsense TA. I can get logs in for about half a second and then they just mysteriously stop. A packet trace shows the logs are still being sent and the port is remaining open. splunkd.log has something interesting though: 01-12-2020 17:25:30.970 +0800 WARN DateParserVerbose - A possible timestamp match (Sun Sep 9 09:48:25 2001) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source=udp:5016|host=pfsense_hostname|pfsense| Any ideas please? ... View more

Re: Configuring Splunk_TA_stream 7.1.3 to ingest n...

by in Getting Data In
‎08-15-2019 02:53 AM
1 Karma
‎08-15-2019 02:53 AM
1 Karma
Right, so I managed to get this working. /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf [streamfwd] logConfig = streamfwdlog.conf port = 8889 ipAddr = 0.0.0.0 netflowReceiver.0.interface = IP netflowReceiver.0.protocol = udp netflowReceiver.0.port = 9995 netflowReceiver.0.decoder = netflow /opt/splunk/etc/apps/Splunk_TA_stream/local/inputs.conf [streamfwd://streamfwd] splunk_stream_app_location = https://localhost:443/en-us/custom/splunk_app_stream/ stream_forwarder_id = disabled = 0 [udp://9995] connection_host = ip disabled = 0 index = stream source = stream This is now allowing netflow to both be accepted and indexed correctly by Splunk_TA_stream with the flow being delivered by softflowd within pfSense. Hopefully this helps someone else down the line. Cheers ... View more

Re: Configuring Splunk_TA_stream 7.1.3 to ingest n...

by in Getting Data In
‎08-12-2019 02:42 AM
‎08-12-2019 02:42 AM
Hi, Thanks for the blog post. I've read that in the past, but it doesn't really address much about netflow. Also, as the host is pfSense which runs on FreeBSD, the streamfwd binary doesn't run. ... View more

Configuring Splunk_TA_stream 7.1.3 to ingest netfl...

by in Getting Data In
‎08-11-2019 12:10 AM
‎08-11-2019 12:10 AM
Hi all, It doesn't matter how much I read the documentation https://docs.splunk.com/Documentation/StreamApp/latest/DeployStreamApp/ConfigureFlowcollector or follow tips from https://answers.splunk.com/answers/636437/how-to-configure-the-splunk-flow-collector-setup-i.htmlhttps://answers.splunk.com/answers/743408/streamfwd-is-not-forwarding-netflow-v9-data-to-sh.html I can't get the TA to ingest netflow from pfSense 2.4.4. I have pfSense using the sotftflow package exporting netflow ipfix to my combined SH/Indexer (single instance, home setup) on port 9995. I have the Splunk UF installed on pfSense and it is configured to use a deployment server if needed. I have SE running on Ubuntu 16.04 v 7.3.1 with Splunk Stream 7.1.3 installed as the app and with the TA. I have the following configs: /opt/splunk/etc/apps/Splunk_TA_stream/local/inputs.conf: [streamfwd://streamfwd] splunk_stream_app_location = https://splunk-enterprise/en-US/app/splunk_app_stream disabled = false index = netflow [streamfwd] disabled = false source = stream [udp://9995] connection_host = ip source = stream index = netflow disabled = false /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf: [streamfwd] port = 8089 ipAddr = 127.0.0.1 netflowReceiver.0.ip = 127.0.0.1 netflowReceiver.0.port = 9995 netflowReceiver.0.decoder = netflow UDP 9995 and TCP 8089 are listening and working fine. I'm hitting walls here. I have no idea what's wrong or whats happening next. Unusually I get this in streamfwd.log: 2019-08-11 11:16:35 ERROR 140695607523072 stream.CaptureServer - Unable to ping server (19a246f1-d41e-472d-8de4-d42bcfc74f65): /en-US/app/splunk_app_stream/ping/ status=303 I can confirm that /en-US/app/splunk_app_stream/ping/ does not exist... but I have installed from the tgz so I am not sure why it doesn't exist? Sorry, this is all over the place, as is my config, such is my desperation to get this working. Please help. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎08-31-2021 08:36 PM
Karma from
View All