published Splunk Technology Add-On for Mikrotik RouterOS

As some of you know we love these small Mikrotik boxes running RouterOS. They are offering a rich feature set and functionality at a very reasonable price.
We also love Splunk.. so it makes perfect sense to import RouterOS data into Splunk. To have greater value of your data we’ve created a Splunk Technology Add-On for RouterOS.

Development takes place in the git repo hosted at https://git.batchworks.de/andreas/TA-routeros . You can download it from there or from https://splunkbase.splunk.com/app/3845/.

Data is extracted for the Splunk CIM data models network traffic, name resolution (DNS), DHCP and authentication.

How use Splunk DB Connect with H2 databases

Today I got a question from a colleague if it’s possible to connect a H2 database engine to Splunk. It would be great to index events from that database – as it contains security events coming from an anti-virus system.

To index events based on a RDBMS there is Splunk’s well-known DB Connect app (https://splunkbase.splunk.com/app/2686/). Unfortunately the DB Connect support matrix doesn’t mention anything with H2 database – so I decided to test it out.

Read more →