All Apps and Add-ons

How do I make Splunk for Fortigate find data in a specific index where i have my fortigate data?

bria0029
Engager

I can't get splunk for fortigate to use the index where my fortigate data are placed.
When i put index=fortigate before every search the results are comming up perfectly.

my input look like this:
[udp://5140]
index = fortigate
sourcetype = fortigate
no_ appending_timestamp = true

just to clarify that my data are in index fortigate

esix_splunk
Splunk Employee
Splunk Employee

You can also check in the App, the eventtypes.conf. You can add the specific index to each eventtype's search. That should quickly fix the issue. Make sure your sourcetype names match what the app is looking for also. Make sure any changes you make, that you put in the local/eventtypes.conf, and dont change the default. (This will keep the changes when you upgrade..)

On a side note, making sure the index is globally searchable is the recommended..

0 Karma

itdepartment
New Member

In my recent experience I wanted to do exactly what you described. This is a summary of what I did...

  1. create index fortios5
  2. update data inputs udp and set the destination index for this source to fortios5
  3. copy default/macros.summary to local folder and rename to macros.conf
  4. update local/macros.conf section Base Macros definition = index=fortios5 ...
    Based on some info I found here:
    http://answers.splunk.com/answers/25843/palo-alto-app-configuration-procedure.html

  5. Also because some dashboards were timing out I needed to update etc/system/local/web.conf to include this setting:
    [settings]
    splunkdConnectionTimeout = 120

  6. Restart Splunk

  7. Enjoy

0 Karma

yannK
Splunk Employee
Splunk Employee

go to manager > access control > roles and make the index "fortigate" searchable and searched by default for the users of the fortigate app.

0 Karma

bria0029
Engager

Yes, but why is it not nessesery to do this if you are working with splunk for ad or exchange? Also with different indexes and not granted rights in roles.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...