Tango App: No results found.

[ghost]

Maybe someone can tell me, what should I do to check if my Spunk and Tango App works properly?

My honeypot Cowrie seems works because in /log/lastlog.txt I can see accepted logon. Also I can see log in cowrie.log:

[cowrie.ssh.factory.CowrieSSHFactory] New connection: 195.62.52.62:37814 (94.177.248.74:2222) [HoneyPotSSHTransport,11,195.62.52.62] Remote SSH version: SSH-2.0-ssh2js0.3.6
[HoneyPotSSHTransport,11,195.62.52.62] kex alg, key alg: 'diffie-hellman-group14-sha1' 'ssh-rsa'
 [HoneyPotSSHTransport,11,195.62.52.62] outgoing: '3des-cbc' 'hmac-sha1' 'none'
 [HoneyPotSSHTransport,11,195.62.52.62] incoming: '3des-cbc' 'hmac-sha1' 'none'
[HoneyPotSSHTransport,11,195.62.52.62] NEW KEYS
[HoneyPotSSHTransport,11,195.62.52.62] starting service 'ssh-userauth'
 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] 'root' trying auth 'password'
 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] login attempt [root/111111] succeeded
 [SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] 'root' authenticated with 'password'
[SSHService 'ssh-userauth' on HoneyPotSSHTransport,11,195.62.52.62] starting service 'ssh-connection'
[HoneyPotSSHTransport,11,195.62.52.62] avatar root logging out
 [HoneyPotSSHTransport,11,195.62.52.62] connection lost
[HoneyPotSSHTransport,11,195.62.52.62] Connection lost after 0 seconds

But my Splunk with Honeypot Tango App show still empty data (http://imgur.com/a/45Whs). I do not know what should I do next.

[kapiorr]

same issue
tcpdump show incoming data on 9997 port, splunk not

[brianwarehime]

The most common cause of this is mentioned in the readme, which can be fixed by:

You'll need to allow users to search the 'honeypot' index by default. To do this, go into “Settings”, then “Access Controls”, then “Roles”, “Admin”, then scroll all the way down to “Indexes Searched by Default”, then add honeypot to the right-hand column.

If that doesn't work, let me know and we can try some other things.

[kapiorr]

I have reinstalled the splunk forwarder and it works.