|
I am abit new to Splunk. I have setup the ossec server with: 6.7.8.9 10002 using the IP of the SPLUNK server. I have successfully installed the Ossec APP, it is not geting any data into Splunk when i look at the dashboard, what other configuration am i missing? |
|
As rayfoo suggested, a clearer explanation of what you mean by "limited data" would go a long way toward understanding your problem. This is a fairly old question, so not sure if it's still an issue, but here are some things to try / questions to ask when troubleshooting:
Are you running the latest version of the Splunk for OSSEC App? There have been some significant changes from 1.0.x to 1.1.x of the app, and there will be several more in 1.2.x. Does the issue appear with just dashboards, or do you have issues with the saved searches as well? What happens if you search on Do the records coming into Splunk have the correct sourcetype? See the Data Inputs section of the README file for the recommended sourcetype values. If they are incorrect, you may need to adjust your Inputs configuration. The dashboards currently look for specific OSSEC servers, so try running the search: |
