Hello,
Can somebody please help explain the difference between the Splunk for Fortinet FortiOS 5 and Splunk for Fortigate apps?
I have a fortinet v.5.0 ...enabled log forwarding to the Splunk server. Logs are displaying in the Search & Reporting app correctly ...but how can I connect FortiOS 5 app with my fortigate? I am totally new to Splunk and maybe it's not clear what I'm searching, but is it possible to directly connect via the FortiOS 5 or Fortigate app to my the Fortigate Machine???
Thank you very much in advance
Hi gerisplunk,
Splunk for fortinet just support fortios version 4 and this app is incompatible with fortios 5.
In "Splunk for Fortinet FortiOS 5", you have a new extractions based on the FortiOS 5 new log format.
Installation Instructions:
The Splunk for FortiOS 5 can be installed by either the Splunk app setup screen, or by manually installing and configuring the app.
Once the app is installed, you need to configure the FortiGate firewall to send the logs to Splunk (udp/513 port). Below is shown the required commands to configure the firewall to send the logs (at date, FortiOS 5 do not support syslog configuration in the Web UI):
config log syslogd setting
set status enable
set server splunk_ip
set port 513
end
I love create my own dashboards and then I create my apps, because splunk is esay. Enjoy it.
Just check this ebook:
http://www.splunk.com/goto/book
Cheers!
How do I turn off logging from the fortigate if I decide to stop using splunk?