How to set up and add CISCO L3 switches to Splunk ?

grandeurxg — Mon, 04 Jan 2016 15:58:57 GMT

Hi,

I'm very new to Splunk. My manager gave me a task how to add CISCO L3 switches to Splunk.
My manager said the switches are able to send logs to the syslog, but the syslog server does not save the logs.

Could somebody give me instructions to add CISCO L3 switches to the Splunk ?

Thank you for reading and please help.

Re: How to set up and add CISCO L3 switches to Splunk ?

dcharboneau_spl — Mon, 04 Jan 2016 17:01:36 GMT

Docs Here.
http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/SyslogTCP

Splunk Addon for Cisco IOS based devices:
https://splunkbase.splunk.com/app/1467/#/documentation

Considerations:
1. Best practice to send syslog to a centralized syslog server. Install a universal forwarder on the syslog server and tail syslog log files.
2. Create an Index to store the data and set Access Control / Retention
3. Any TA's or Splunk Apps you can use? https://splunkbase.com search for cisco.

Hope this helps.

topic How to set up and add CISCO L3 switches to Splunk ? in Getting Data In

How to set up and add CISCO L3 switches to Splunk ?

Re: How to set up and add CISCO L3 switches to Splunk ?