About Jess_1

Jess_1 · ‎04-04-2013

No you can't at this time - I wanted this same functionality of having the Event Options menu in a Results Table, so I asked Splunk support and they advised it's not possible at this time. I'll probably submit an ehancement request.

Jess_1 · ‎05-12-2011

SOLVED: I installed the Splunk for Cisco Firewalls app (and the Splunk for Cisco Security app - because this provides the views and searches to make use of the Splunk for Cisco Firewalls app) on BOTH my heavy forwarder and my indexer. The install was needed on the forwarder in order for the data to get sourcetyped correctly and have fields extracted correctly, etc. With the app only installed on my indexer, the data was not getting its sourcetype, fields extracted etc. The install is indeed also needed on the indexer so you have an interface to the views, dashboards, searches etc that the Splunk for Cisco Security app provides. Perhaps it's possible you don't need the Splunk for Cisco Firewalls app installed on the indexer, and that you don't need the Splunk for Cisco Security app on the forwarder, but I didn't try this - I just have both installed on the forwarder and indexer.

Jess_1 · ‎03-29-2011

Hi jb thanks for your help. I added more descriptions of my problem and my setup onto dleung's post above. I have it setup as you describe however charts don't show the data. If you have any further suggestions let me know, tia.

Jess_1 · ‎03-29-2011

Right now I only have the app installed on indexer. I didn't define any inputs for it because it only offers TCP or UDP inputs in it's Splunk Web Configuration. I made it visible, and the searches it offers seem to return results with fields extracted, but the built-in charts say no data. So I'm guessing I need to manually configure the heavy forwarder and indexer so the events get "associated" to the app and thus intelligence can be made out of the data properly. But I can't find any documentation how to config Splunk/the app in my scenario using a heavy forwarder to monitor log files.

Jess_1 · ‎03-29-2011

Hi dleung, thanks for your help here. Yes the log files contain the firewall messages. However, the forwarder doesn't receive the firewall messages via syslog directly - syslog-ng receives the syslog messages from firewalls, writes them to log files, and the forwarder then monitors those log files. I'm using a heavy forwarder. So now that I've explained this more clearly, would you still say I need the app installed on the heavy forwarder and the indexer? How do I associate the data inputs (log files) with the app, or is this not necessary and it's automatic?

Jess_1 · ‎03-26-2011

Hi, what's the proper config regarding Data inputs to use the Splunk for Cisco Firewalls app on data received from a forwarder? In the app setup (using Splunk Web) it only gives options to get data from a TCP or UDP port. I'm using the most recent Splunk for Cisco Firewalls app 1.0.0 and Splunk 4.2. My forwarder has several Data inputs defined as log files on its local machine. It is not, and I don't want it to do, indexing. Also should the app be installed on the Indexer, or both the forwarder and indexer?

Posts	6
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎03-26-2011

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

inputs for Cisco Firewalls app when using forwarde...

Re: event options menu within table view?

Re: inputs for Cisco Firewalls app when using forw...

Re: inputs for Cisco Firewalls app when using forw...

Re: inputs for Cisco Firewalls app when using forw...

Re: inputs for Cisco Firewalls app when using forw...

inputs for Cisco Firewalls app when using forwarde...