Splunk Client Policy Configuration Items

Splunk server

The IP addresses of one or more Splunk servers that are sending data to the Tenable Log Correlation Engine Splunk Client.

In order for the Splunk Client to function, you will need to edit the Client policy, include the required syntax noted below, and specify your Splunk server.

XML Example:

The port to which the Splunk servers are sending data.

XML Example:

The IP address or hostname and port number of the syslog server that you want the Tenable Log Correlation Engine Splunk Client to forward events to in addition to the Tenable Log Correlation Engine server.

XML Examples:

<IP or Hostname>:<Port Number>, where

• <IP or Hostname> is an IP address, or a hostname that is a maximum length of 46 characters.
• <Port Number> is an integer from 1 to 65535.

The custom delimiters that you want to apply to parse events in Splunk logs. You can include multiple Delimiter entries in your policy.

Note: By default, the policy includes the delimiter for Windows multiline logs. This delimiter is not required by the policy.

XML Example:

Directory containing files, named according to the date, that contain Tenable Log Correlation Engine Splunk Client log messages.

XML Example:

Caution: This configuration item is deprecated for versions 4.6 and later of the Tenable Log Correlation Engine Splunk Client. Client heartbeat period should be used instead.

XML Example:

The number of seconds between each client heartbeat message to the Tenable Log Correlation Engine server. If not used or set to 0, the client will not send heartbeats.

XML Example:

Caution: This configuration item is deprecated for versions 4.6 and later of the Tenable Log Correlation Engine Splunk Client. Client statistics period should be used instead.

XML Example:

The number of minutes between each client host performance statistics report (CPU, Disk Space, and Physical Memory) to the Tenable Log Correlation Engine server. If not used or set to 0, client statistics will not be sent.

XML Example:

Whether client will compress log data prior to sending it to the Tenable Log Correlation Engine server in order to save bandwidth. Recommended except when debugging. If set to 0, events will not be compressed.

XML Example:

Compression level to use when compressing events for transmission across network using zlib, set on a scale from 1 to 9. 1 provides the least amount of compression, resulting in minimum CPU usage and minimum bandwidth savings; 9 maximizes compression, resulting in increased CPU usage and maximum bandwidth savings. Ignored unless compression is enabled.

XML Example:

Defines the minimum acceptable savings ratio for event data being transmitted across the network, in terms of (bytes total) / (bytes compressed). If the client determines a savings ratio of less than this value, then event data will not be compressed before sending. This reduces the effort on the Tenable Log Correlation Engine Server decompressing event data when compression benefits are minimal. Ignored unless compression is enabled.

XML Example:

The minimum number of bytes a packet must have to be compressed. Ignored unless compression is enabled.

XML Example:

Controls the debugging information that is logged.

XML Example:

One of the following values:

• NONE
• VERBOSE
• INFO
• WARN
• ERROR

Maximum number of seconds between event messages the client sends to the Tenable Log Correlation Engine server.

XML Example:

If a host has multiple network connections, allows you to specify which network to use. If not set or if the CIDR does not match any networks, the client will use the first network connection detected.

XML Example:

Path to file for receiving events. Relative paths are interpreted to start at the client's installation directory.

XML Example:

Whether to write events to standard output (stdout). Any event picked up by the Tenable Log Correlation Engine Splunk Client will have the raw log printed to the stdout of the client, the default being a terminal session, before the client sends it to the Tenable Log Correlation Engine server to be processed. This configuration item is useful for debugging and troubleshooting.

XML Example: