Getting Data In

How does Splunk define a host?

olsonc58
New Member

I am a network admin. I followed the documentation on how to connect an F5 load-balancer, Cisco ASA, and Checkpoint Firewall. The only way I could validate logs were making it to the Splunk server was with a packet capture. All searches initially failed. In "Data Summary, my ASA is not listed. The only way I can see any logs is with index=%ASA sourcetype="cisco:asa". I found my F5 listed by IP and clicking on that host DOES show logs. I found my Checkpoint listed by IP. Clicking on that host fails to bring up anything. It is also listed by hostname but nothing comes up with that either. Windows servers do show up by host name and they show results. There are also host names titled 2016, EDT, CST, INFO, UTC, Version, WARN. What are those? They aren't hosts as I know it. This is a mess. How does Splunk define a "host"? We are using Splunk 6.5 - Single Node.

0 Karma

kalianov
Path Finder

Your index "ASA" is not listed in Data Summary because you need to add it into "indexes searched by default".
That's why you have no results when you trying to search without pointing an index name.
Сheck "Indexes searched by default" in Access controls->Roles
always after you create new index.

somesoni2
SplunkTrust
SplunkTrust

The Splunk definition of host can be found here, with details how Splunk assigns it.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Abouthosts

About the sample values like 2016, EDT, CST... in your case, it seems a wrong regex being used to capture/assign host values.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...