Modsecurity not working

[dolfantimmy]

I've read the other posts about this issue but none seem relative. I have a single splunk instance installed on my local PC. I have installed the modsecurity app and related apps. I have added a local file input for modsec_audit.log. I can see the data when querying from the search tool, but I get no data from within the modsecurity app.

When creating the data input, modsec_audit was not available in the list for sourcetypes. Attempting to create it told me that it already existed. So I created the sourcetype modsec_audit2, and modified the modsecurity macros.conf to reflect this. The input is directed to main db so that is not the issue.

Any assistance will be greatly appreciated.

[rsennett_splunk]

Hello there...

First, regarding the sourcetype:
In order for a sourcetype to show up in the dropdown list in the inputs form the sourcetype definition must have a line like this:
pulldown_type = true
the [modsec_audit] definition that comes with the app does not.
So you could have selected "manual" and just typed it in.

however, as it explains in the documentation, it's perfectly legitimate to use another name. However, from what you've described, you now have a stanza that is called [modsec_audit2]
be sure it contains the same entries as the [modsec_audit] definition found in
$SPLUNK_HOME/etc/apps/modsecurity/default/props.conf
as there are some essential field extractions in there...

As for the dashboards not populating even though the index is populated...

Best thing to do is to take a look at the searches that the dashboards are running.
One of my customers had the same problem, and it turned out that he simply wasn't logging any of the fields that the app author thought were interesting. So the dashboards had nothing to show...

The dashboards are written with Advanced XML but the searches are all Saved Searches.
So you can run them independently. You can see the code for the Dashboards here:
$SPLUNK_HOME/etc/apps/modsecurity/default/data/ui/views/

modsecurity_dashboard.xml for instance runs the following saved searches
that look like this: <savedSearch>Modsec denied by ip</savedSearch>

modsec_index modsec_src |stats dc(msg) as Messages by clientip |sort - Messages |head 10

check out savedsearches.conf and run them... see what you can see.