Getting Data In

missing fields in linux installtion compared to windows

terryblair
New Member

I had splunk running on a windows machine with my cisco asa 5505 sending syslogs too it and I was able to see destination ips and a bytes_in field but now ive moved to splunk to an ubuntu box, all the destinations ips are just our external ip and the bytes_in field seems to of disappeared completely

0 Karma

netwrkr
Communicator

How are you getting the logs to the linux box? Direct through a splunk forwarder or syslog or? Can you view the raw logs and see if the fields you seek are present? If you look at 'show source' within splunk are the fields present?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...