Hey all, Our raw syslogs are showing IP addresses of sourced events, but the results in Splunk is changing the IP addresses to their respective hostnames/FQDNs. If I want to see the results without the name resolution how can I do this? I just need to see the IP addresses, as per the actual raw syslog. Thanks, Will   ... View more

Hey all, I need some advice regarding our syslog storage facility. We're using rsyslog and at the moment we've got all firewall logs going into a single log file, which is getting pretty large at this point. I'm then using the universal forwarder to send this over to Splunk. The log file at the moment is around 150gb and growing. We've got plenty of space but I was wondering, is there a better way I should be approaching this? For example, should I break the logs up so that each Firewall has it's own directory and new sub directories per day?   Any insight would be appreciated.  Thanks, Will ... View more

Hey everyone, I've got all our firewall logs going into separate index. When I perform a search just using the index as a value, for example index="sec-firewalls" the results vary quite a bit. I get nothing for real-time unless I select all time (real-time). Under relative results I get nothing for today. Nothing for last 15 minutes, last 4 hours etc. Again, the only option that works is All time. When I'm looking at real-time results, it's about 2hr30m behind. I am using the Splunk Add-on for Cisco ASA for this index. Anyone able to assist me with what's happening here? Thanks, Will ... View more

Hey all, I'm looking for some advice. We currently have multiple ASAs which are sending logs to rsyslog. The logs are stored in folders based on the hostname. I currently have the universal forwarder monitoring the parent folder. When it comes to using Splunk addons such as "Firegen Log Analyzer for Cisco ASA". It's asking to specify an index. Do I need to compile all the logs from the ASAs into a single directory and then create an index for it? Both rsyslog and splunk on are linux (ubuntu) hosts. Any help would be appreciated. Thanks, Will       ... View more