Everyones input files are site specific and cannot be defined by the TA. The TA is a technology adapter which (mostly) applies to the search head. This one has some applicability to your heavy forwarder. For example if you were running syslog-ng and had all of the plumbing done correctly in syslog-ng: inputs.conf file: [default] host_segment = 4 [monitor:///logpartition/logs/meraki/*/2016/...] sourcetype = meraki index=meraki However the config above is site specific. In order to build one you need to look at your input plumbing architecture. What device are you sending your Meraki logs too? How does the device route logs to your heavy forwarder? You also need to apply your host field somehow. ... View more

The extractions are dependent upon having your inputs.conf setup. That setup is site specific. I put a sample regarding syslog-ng setup. But that isn't relevant in many cases. These set of extractions make no effect on the data or the ability to see the log. You should be able to see the logs by searching for sourcetype=meraki, if you can't... try doing a index=meraki (or whatever index you put your data in). Then when you see the log verify sourcetype and that data is extracted. ... View more

User names are going to have to be populated from a third party source. For example with active directory there are a couple of ways to solve it. One is by linking syslog-ng to a lookup table and doing re-writes on the logs and append the user information there. The other way is by doing the classic AD lookup table method. Getting that information on all log types directly from Meraki is going to be very problematic without enhancing the logs along the way. ... View more

I pushed out a new release into the repo: https://github.com/AlaskaSSO/TA-meraki/releases/tag/v1.1.2 If it looks good I'll push it up to the splunk app store. ... View more

I remember running into this as well! A feature request needs to go into Meraki in order to ask them to exposed the actual group policy that was triggered. Sorry :(. No hope on this one. ... View more

Could you email me directly some log entries? It could be a meraki limitation, but I've been able to solve issues before by building jobs which post lookup tables automatically in order to fill them out. I'd like to visualize what it is you are seeing. Thanks, -Myron ... View more

I'm unfortunateily (still) not getting notified when people add comments in regard to this app. They should be mapped/tagged and aligned properly. Any chance you could send me a sample log to my email address so I could import it into a test index on my system? ... View more

Sorry about the long delay. I updated the details section of the app. ... View more

I'll investigate. That was one I never caught... sorry. The purpose was for the DHCP tag under the common information model "Sessions" DHCP lease_scope string The consecutive range of possible IP addresses that the DHCP server can lease to clients on a subnet. A lease_scope typically defines a single physical subnet on your network to which DHCP services are offered. I thought I tested it against several different pieces of data. But I missed that one :(. After testing it I'll upload a new package. ... View more

I apologize for those docs. I modified the README: https://github.com/AlaskaSSO/TA-meraki/commit/4bf185dec157e85f0c2facc7b7c6746c26891c3c At some point in the past I used SHOULD_LINEMERGE=false. I don't even know at this point the case that required it. ... View more

Sorry for the long delay. Apparently my subscriptions to be notified of forum posts regarding this tag was not working. 1 On our Heavy Forwarder, we can add a different UDP port for this data. Meraki can also forward on this port. Do we need to install the app on the heavy forwarder? Yes and no (optional). There is one piece that executes on index "TRANSFORMS-meraki_date_clipper". Basically all it does is clip out the unix timestamp in preference to the syslog timestamp. Completely unnecessary (unless you want to save a few bytes in your log). 2 Do we need to also install the app in the cloud? Yes 3> Or should we only install in the cloud and add the port on the heavy forwarder and force the sourcetype for that port to be “meraki”? You'll still need the sourcetype by Meraki, which would be done on your heavy forwarder... but you'll need this on your search head (i.e. the cloud) ... View more

Sorry for the long delay; somehow I'm not getting notified when responses come in. This TA is only a set of extractions to make it comply with the common information model. With any common information model dashboard that uses the relevant models you will get visualization. This is the foundation... everything else can be built on top of this extraction. ... View more

What about configuring meraki to send on a different port than 514 and just force all incoming data on that port to type meraki? ... View more

I would like to apologize; I never saw this message. Looks like spam control grabbed it. TA-meraki must to be installed on the search head. It is optional to install on the indexer. (I didn't see where you explicitly said you installed it on the search head... just on the indexer). I'd like to verify a few things. When you do a index=meraki you say the data is there correct? And it is also listed as sourcetype=meraki correct? And when you search you do not have "fast mode on", you have smart mode or verbose mode on correct? Additionally in Enterprise Security you MUST have acceleration enabled for the relevant data models. (was that done?) This shouldn't matter but are you running the latest version of TA-meraki? ... View more

I currently run 14 indexers over ~250 spinning disks with raidz2. I've been running splunk over zfs for over 3 years. No problems, in fact I initially ran indexers with several different backends and zfs was the most stable. My main indexer is a 1U supermicro box with a cost of ~5k. Box has 12 spinning media drives (raidz2), used Hitachi Ultrastar drives. 2 SSD's for bootup disks. Then install a PCI NVMe drive for your cache drive. (2-4 or so gigabytes per second speed). I'd recommend altering the default settings of zfs so it'll be more aggressive with using the NVMe drive. Get at least 12 cores in order to remove the annoyance about Enterprise Security complaining <12 cores. ... View more

I haven't tried sending the meraki logs directly to splunk; I've always sent it to a syslog server instead. As long as you apply the data as sourcetype=meraki and put it into index meraki from splunk it should still pick it up. I would probably create a new port (i.e. 51411 in splunk), and force sourcetype=meraki and index=meraki. (thereby not to interfere with anything else) If you do this, you will need to go into the meraki dashboard and select the alternative new port. The docs I wrote were targeting on boarding the data via syslog-ng as a sample. As soon as you do that and you have the TA loaded it should pick it up automatically. ... View more

I've been running splunk for years now on ZFS, using many terabytes of disk. This may be off topic. I've tested both btrfs and zfs. The version of btrfs I was running (albeit this was a few years ago, maybe fixed?) had massive problems when I tried it with auto snapshot turned on a heavily loaded system. None of those problems existed with zfs. Even through btrfs is officially supported now, I recommend against it. ZFS with lz4 works very well. ... View more

This has to be deployed to all of the python scripts. i.e. for geoasn.py: before: line[src_countryi] = unicode(src_gir['country_name']) after: t = src_gir['country_name'].decode('cp1252') line[src_countryi] = unicode(t) and before: line[dest_countryi] = unicode(dest_gir['country_name']) after: t = dest_gir['country_name'].decode('cp1252') line[dest_countryi] = unicode(t) Thank you for solving my problem as well. ... View more

I don't ship out the maxmind database via search bundles. I use the system maxmind database; if you run debian and install the package geoip-database-contrib; each machine that has that package will be kept auto-up-to-date and if you modify each python script to point to the system maxmind database there is no need to worry about blacklists and the search bundle getting too large. for example: asn.py DB_PATH = os.path.join('/usr','share','GeoIP','GeoIPASNum.dat') Done; never worry about large search bundles or updated maxmind databases again!,What I've done is edit the lookup script to point to the system maxmind database. ... View more