×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
dikaaditsa
Loves-to-Learn Lots
Member since: ‎09-19-2024
‎09-23-2024
Community Statistics
Posts 7
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎09-19-2024
View All

Re: Ingest fortigate logs to splunk

by in Deployment Architecture
‎09-20-2024 01:44 AM
‎09-20-2024 01:44 AM
Dear @PickleRick  I follow using this step https://www.fortinet.com/content/dam/fortinet/assets/alliances/Fortinet-Splunk-Deployment-Guide.pdf but there's not solve the issue. ... View more

Re: Ingest fortigate logs to splunk

by in Deployment Architecture
‎09-20-2024 01:41 AM
‎09-20-2024 01:41 AM
Dear @PickleRick  Thankyou for your correction , do you have any sugestion or best practice for me ?   Regards, Dika ... View more

Re: Ingest fortigate logs to splunk

by in Deployment Architecture
‎09-20-2024 01:26 AM
‎09-20-2024 01:26 AM
I found notfication : File Monitor Input Forwarder Ingestion Latency Ingestion Latency Large and Archive File Reader-0 Large and Archive File Reader-1 Real-time Reader-0 Real-time Reader-1 are reds too.  is it because too much logs sent from fortigate? ... View more

Re: Ingest fortigate logs to splunk

by in Deployment Architecture
‎09-19-2024 09:05 PM
‎09-19-2024 09:05 PM
Is there any step or checklist for me to first step check or tshoot regarding this, I just currious why the logs is stop ingesting to splunk because previously I don’t have any issue using this way.  ... View more

Re: Ingest fortigate logs to splunk

by in Deployment Architecture
‎09-19-2024 09:04 PM
‎09-19-2024 09:04 PM
I did not write the logs into the file because lack of resource.  ... View more

Re: Ingest fortigate logs to splunk

by in Deployment Architecture
‎09-19-2024 09:02 PM
‎09-19-2024 09:02 PM
Hi @gcusello  Thankyou for your answer, I did not install any add ons for fortinet.  sure, I have 1 SH and 2 indexer actualy but I only ingest the log to 1 indexer. The others log from another service are ingest correctly and can be search in SH.  ... View more

Ingest fortigate logs to splunk

by in Deployment Architecture
‎09-19-2024 03:37 AM
‎09-19-2024 03:37 AM
Hi All,  I already configure ingestion log from fortigate using syslog , the log send using UDP by port 514.  I also setup data inputs in splunk enterprise to recieve the data from port 514.  When I perform tcp dump from splunk vm , the data successfully flowing from fortigate to splunk vm, but when I search the data from splunk web, there is no data appear.  Currently I ingest the data to 1 indexer, and search the data from another search head.  Please give me an advise to solve my issue.    Thankyou ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎09-23-2024 06:49 AM