I just moved my Splunk indexer from one server to another. A few bumps in the road, but everything seems to be working now, except for that fact that two hosts will not resolve in DNS, so Splunk is indexing them as IP addresses instead. They are located on a different network than the Splunk indexer, but they still resolve in DNS. Old server was running CentOS, new server is running Ubuntu 18.04. All other hosts that I index run Splunk universal forwarder, and when those logs make it to my indexer, they are already coming in with hostnames and not IPs. The traffic is coming on typical udp/514, one from a cisco ASA, the other from a Cisco Switch. Prior to moving the Splunk instance, hostnames resolved fine. The DNS server is the same as it was before. They resolve fine with nslookup: [root@splunk ~]$ nslookup 192.168.50.2 2.50.168.192.in-addr.arpa name = Switch. Authoritative answers can be found from: [root@splunk ~]$ nslookup 192.168.10.50 50.10.168.192.in-addr.arpa name = CiscoASA. Authoritative answers can be found from: Any idea why these wouldn't resolve with Splunk indexer? ... View more

Not really a question, but wanted to pass this along, as this appears to be the only forum around for this app. Be on the lookout when you have bandwidth monitor enabled. I forgot that I had enabled it, and when I looked at my bandwidth over the past few months, noticed a huge tick in my average bandwidth usage. In my case, I noticed Bandwidth monitor using about 20Gb of data a day. If you look at inputs.conf, I believe it is disabled by default. In my case, I enabled it months ago and forgot about it. I just disabled it - since i don't use this function in homemonitor - and just like that, my bandwidth usage dropped by an avg of 20gb daily. Alternatively, you can change the default interval from "1800" to something much higher. I'm assuming 1800 is in seconds, so default is every 30 minutes. Each test must process about 400Mb (though was not able to determine exact amount of usage per test), 48 times a day, which gives you close to 20Gb of bandwidth just for speedtests. Over the course of a month, that's close to 600Gb of usage. Definitely problematic if your ISP has a bandwidth cap. ... View more

Hello all. I'm trying to get this to work with tomato, and I'm having no luck. I'm following the instructions that are on the wiki but still nothing. My setup may be a little different than the instructions, so possibly i'm missing something basic. My logs that are coming over syslog come in as: host=192.168.40.1 source=udp:514 sourcetype=generic_single_line In lots of the documentation it says to specify the hostname of the router, but given that it is coming in as an IP and not a hostname, I don't think that would work. I've followed https://github.com/amiracle/homemonitor/wiki/Issues-with-Setup-Page-%28404-Error%29-Fix---work-around to get the main setup working. So my files look like this: app.conf [install] is_configured = 1 props.conf [host::192.168.40.1] TRANSFORMS-homemonitor = index_redirect_to_homemonitor transforms.conf `[index_redirect_to_homemonitor] REGEX = . DEST_KEY = _MetaData:Index FORMAT = homemonitor [tomato] Make sure that this matches the hostname of your router, tomato is just an example. REGEX = 192.168.40.1 SOURCE_KEY = MetaData:Host FORMAT = sourcetype::tomato DEST_KEY = MetaData:Sourcetype` What else am I missing to make this work properly to read the tomato log files? ... View more