Add helper app to intermapper update#
Let me know if that helps and I will update our documentation and testing scenarios. Intermapper offers device-based licensing, so you only pay for the number of devices you want to monitor, starting at 10 devicesall the way to unlimited. If you are using 514 for other logs, you could set InterMapper to a different UDP port and match the change in the nf
Add helper app to intermapper install#
So I think for the deafult InterMapper install (UDP, port 514), adding the following to the forwarder nf would work. Then specify the source type by including a sourcetype attribute In the stanza, identify the source path, using regex syntax for flexibility if necessary. To override source type assignment, add a stanza for your source to nf. If you do it in nf on the receiver, the override will not take effect. Important: If you are forwarding data, and you want to assign a source type for a source, you must do this in nf on the forwarder. Chose the Customize option from the Launch submenu.
First, startup InterMapper and right-click (or Option-Click on MacOS X) on any node. The various parameters you have to enter depend the platform. I do not have personal experience with this, but I did find this on Splunkbase: On all platforms, you will need to add Telconi Terminal as a helper application for InterMapper. If you have all InterMapper syslog being written to one file which is then in its own monitor stanza in nf on the forwarder you can just add the line Īnd this will send all events with the InterMapper sourcetype. Built In - Select an Intermapper menu command from the menu tree. Open URL - Type a URL in the Action text box. You will need to restart Splunk for these changes to take effect and if you make these new files in the local directory instead of changing the existing ones in the default directory then it will prevent any updates breaking your setupĮDIT: Just as a side-note, although I don't think you should have an issue with the description of your setup you may also need to do the following instead on the forwarder. Use the Action dropdown menu to choose from these options: Helper App - Select a helper application to launch. This should start correctly parsing all incoming events sent from your forwarder to the sourcetype InterMapper. TRANSFORMS-intermapper = intermapperSourceType You can configure a notification, such as a sound, to alert you whenever a new device is detected. Intermapper will automatically detect new network devices and display then in the DetectionMap, a separate map interface. Here you need to create two files with the following contents As of Intermapper 6.1, you can schedule new device detection to occur at scheduled times. Hey, to fix it for your setup navigate to $SPLUNK_HOME/etc/apps/InterMapper/local on the indexer where the app is installed.
0 kommentar(er)
