Explorer III

Solved

Log Source SIEM

Forum|Forum|2 years ago
November 12, 2023
8 replies
7771 views

Hi guys,

In fortisiem, some of the log sources are sent to supervisor and some to collector. Is there any way to see this on the GUI other than getting a dump?

Fortisiem

Best answer by Richie_C

Hi

I'm thinking that you could achieve it with an analytics search. I don't actually have a collector in my test setup, but my idea is to search all logs and then aggregate the search with reporting IP and collector name or collector id. Then use the count function as per the screenshot. I'm not sure if it will work if you have loads of events, but maybe you could play around with the filters to help narrow down the search.

I hope it helps!

Anthony_E

Staff

Hello Adem,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Best Regards

Anthony_E

Staff

Hello Adem,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

Best Regards

heng

Staff

Hi there,

May I know what is the ask here to be more specific? You want to look at the formatted log (Under GUI Analytic) or the achieve log via GUI?

adem_netsysAuthor

Explorer III

Hi, i'm sorry for late reply. For example, we want the products in the customer environment to send logs only to the collector, but there were products that sent logs to the supervisor before. Can I see where the log is coming to the supervisor on the gui?

Richie_CAnswer

Staff

Hi

I'm thinking that you could achieve it with an analytics search. I don't actually have a collector in my test setup, but my idea is to search all logs and then aggregate the search with reporting IP and collector name or collector id. Then use the count function as per the screenshot. I'm not sure if it will work if you have loads of events, but maybe you could play around with the filters to help narrow down the search.

I hope it helps!

Capture.JPG

Sign up

Login with SSO

Login to the community

Login with SSO