All right, so one last video, we made sure we were collecting the correct logs from P.S. one and we
modified the inputs Dukkha to get it working.
Now, off camera, I did the same thing for you and for the DC.
So all Windows logs are now being adjusted in this system on partial logging.
All that good stuff.
Also, the other thing I did was I went to the Splunk Enterprise when I clicked the settings and I bumped
up the memory to eight gigabytes.
Now, you might want to do this if you want to get better performance.
I have the resources on my hosting machine to make an eight gigabyte bump inconsequential.
And I suggest you do the same if you can, because you Splunk searches will be a lot smoother.
All right.
If you can't, it's OK.
You can still follow along.
All right.
So if we close out of that and now we're at a place where we can start.
So PC one or two and DC have all locks being quoted in this book.
But we need to create a few indexes and we need to disable Splunk Anonymous telemetry and then we'll
be able to configure the appliance to forward the logs into Splunk as well.
So I'm just going to log into Splunk and I'm going to create these indexes first so we can knock this
out.
And it's really straightforward, really easy.
You'll see.
All right.
So I'm going to go to Settings Indexes.
And you can see some of the indexes we have here, but we're going to do is we're going to create a
new index for the network, for Surakarta and for our show.
So I'm going to call it network.
This is going to be our firewall.
Save.
Civica.
And our show.
All right, so we've got those here, it's the power sharing network in Turkey.
Very cool.
Now we need to disable the instrumentation.
Because spunk by default will send anonymized telemetry to Splunk.
And, you know, I don't want that to happen.
You don't need to send data out.
We shouldn't send it out.
Right.
So it's saying no data was sent in the last 30 days.
That's fine.
I'm going to make sure no data is sent ever.
So we put the clock next to user usage data and then we're just going to disable the aggregated usage
data.
And we want to disable the support usage data.
Nice.
All right, so we are good to go there now.
We're going to do flip over to our open sense appliance.
Let's get this thing working.
All right, so we're going in we're going in right to the first thing we're going to do is we're going
to go to settings under system.
And we want to go to the logging targets.
We're going to do is add a new logging destination, so we're going to click the plus sign right here.
And we want to enable of course, we're going to use UDP for the applications, we're going to select
nothing, because if you look at the full help, that means that all the applications are going to be
forwarded.
OK, we want all the levels to be forwarded, all the facilities.
This is for this log and then for the hostname.
We're going to put in our Splunk index, right.
Change the port to five one four seven, and then we will give it a name.
We'll just call it ship open since logs to Splunk.
All right.
All right, now we need to make sure we apply it, as the message told us, we're going to click apply.
Let's go.
Let's flip back over to Splunk.
Let's go back into the Splunk Enterprise Search and reporting app.
Now we're going to do is we're going to set up a new data input.
So we're going to go to settings.
Data inputs, because we're sending the data to Splunk, but right now, Splunk doesn't have a way of
capturing it.
What's it doing?
A baseball at someone without a glove and the other person can have a hard time catching it.
So we're going to give Splunk the glove it needs to catch the logs.
So under UDP, we can click, add new and guess what we're going to put in here for the port.
If you said five one four seven, you're getting the hang of it, right?
It's not not too difficult.
Well, you know what to do.
It's not too difficult.
Right.
All right.
The UDP selected.
We're going to put five one four seven as a port.
And let's see everything else.
Looks good in here.
Could next.
And for this source type, we're going to put an open sense, no, it's not there.
Where's it?
Oh, that's why it not showing up, because we don't have the open sense app, so let's go ahead and
install that first.
I'm going to control click this and go to manage apps.
We need to install two apps, the SIM and the Open Sense app.
All right, let's type in first the common information model, this will normalize all the log data
to a standard format.
So here it is, this Splunk common information model.
We need this app.
And we're going to put in our Splunk dot com credentials.
Log in and continue.
Sweet, and then we'll get the open sense apps.
The open sins out on Facebook and the open up Facebook.
Nice.
Let's get the other one.
Again, this is providing all the passing of the log data so that all the fields are in the right place
and we can start to look at some really fun data.
So now let's go back to this dashboard.
Might need to refresh this page.
All right, take me back here, but I want to go to data inputs.
UDP, a new group, selected five one four seven.
All right, let's good quick next source type.
Now we get open sense, so we want this one right here without all the stuff after just open since.
And then for the method for the host went to Pakistan.
We're just going to put in the name of our open since appliance and then for the index, try to guess
what we're going to put here network.
All right.
Looks good.
We quick review UDP five one four seven.
And it is open source, source type.
Open Seats is the host name of the host and index is going to be network simit.
Let's go and start searching CyberWorks.
Moment of truth, right?
OK, that is a good sign.
We've got some data coming in, let's tidy the search up a little bit.
So let's say index network source type equals open since star.
There we go.
I was looking for this.
These bills are broken out, so what it's actually done because we have the logs and everything configured
correctly.
Now we're seeing the breakdown of these weblogs.
Right.
If I click on one of these logs in the event list.
Think it's under event actions to be the role of.
The source was going to try to show you the raw log so you can see, you know, the magic that these
yeah, so this is kind of the prologue.
So all this this raw data is being passed into this pretty log data here.
So everything's broken down by feeling a value because we have the technical the technical attachments
and the other tags for open installed.
So that is really, really good.
And now we have open since firewall data inside of our around tax will be able to see those here in
the next lecture.
We're going to make sure it's configured correctly for Surakarta.
So we'll see you guys in a little bit by.