topic Re: Is there an add-on for the Cisco Meraki devices? in Splunk Dev

Is there an add-on for the Cisco Meraki devices?

danielbb — Tue, 28 Jun 2022 18:40:07 GMT

We have many Cisco Meraki devices sending data via syslog to Splunk. Is there an add-on for the Cisco Meraki devices, to extract the fields from the events.

One more thing. do the Meraki devices support json?

Re: Is there an add-on for the Cisco Meraki devices?

richgalloway — Tue, 28 Jun 2022 19:55:27 GMT

Searching splunkbase (splunkbase.splunk.com) for "meraki" returns six results. Perhaps one of them supports syslog.

You'll have to ask Cisco about Meraki support for JSON.

Re: Is there an add-on for the Cisco Meraki devices?

Roy_9 — Tue, 28 Jun 2022 21:41:58 GMT

Hello,

https://docs.splunk.com/Documentation/AddOns/released/Meraki/About

https://splunkbase.splunk.com/app/5580/#/details

Thanks

Re: Is there an add-on for the Cisco Meraki devices?

danielbb — Wed, 29 Jun 2022 15:48:55 GMT

>You'll have to ask Cisco about Meraki support for JSON.

Amazing point !!!

Re: Is there an add-on for the Cisco Meraki devices?

danielbb — Wed, 29 Jun 2022 15:49:53 GMT

Thank you, but I'm looking at data that comes as syslog from these devices.

Re: Is there an add-on for the Cisco Meraki devices?

danielbb — Wed, 29 Jun 2022 16:56:34 GMT

The Cisco guy told us -

syslog export in JSON format is not a viable request. All the syslog data is sent in arrays. This is in accordance to RFC5424 export format standard for syslog.