Getting Data In

How does Splunk define a host?

olsonc58
New Member

I am a network admin. I followed the documentation on how to connect an F5 load-balancer, Cisco ASA, and Checkpoint Firewall. The only way I could validate logs were making it to the Splunk server was with a packet capture. All searches initially failed. In "Data Summary, my ASA is not listed. The only way I can see any logs is with index=%ASA sourcetype="cisco:asa". I found my F5 listed by IP and clicking on that host DOES show logs. I found my Checkpoint listed by IP. Clicking on that host fails to bring up anything. It is also listed by hostname but nothing comes up with that either. Windows servers do show up by host name and they show results. There are also host names titled 2016, EDT, CST, INFO, UTC, Version, WARN. What are those? They aren't hosts as I know it. This is a mess. How does Splunk define a "host"? We are using Splunk 6.5 - Single Node.

0 Karma

kalianov
Path Finder

Your index "ASA" is not listed in Data Summary because you need to add it into "indexes searched by default".
That's why you have no results when you trying to search without pointing an index name.
Сheck "Indexes searched by default" in Access controls->Roles
always after you create new index.

somesoni2
SplunkTrust
SplunkTrust

The Splunk definition of host can be found here, with details how Splunk assigns it.

http://docs.splunk.com/Documentation/Splunk/6.5.1/Data/Abouthosts

About the sample values like 2016, EDT, CST... in your case, it seems a wrong regex being used to capture/assign host values.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...