https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-data-from-my-Cisco-switch-into-Splunk/m-p/206399#M40720 <P>The best practice is to use a syslog aggregation tier and then use the Universal Forwarder on top of your syslog server(s). This gives you the most reliability, auto-load balances the data if you have a distributed setup and will not cause data loss if you need to re-start your Splunk infrastructure. I highly recommend you go this route.</P> <P>If you don't have syslog servers then you can syslog directly to Splunk.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Monitornetworkports">http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Monitornetworkports</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/HowSplunkEnterprisehandlessyslogdata">http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/HowSplunkEnterprisehandlessyslogdata</A></P> Fri, 10 Jun 2016 16:28:49 GMT shaskell_splunk 2016-06-10T16:28:49Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-data-from-my-Cisco-switch-into-Splunk/m-p/206398#M40719 <P>I am new to Splunk. I have set it up on my server, set up an indexer, and set up the logging in my switch, but I have no data. I do not see the option for Cisco:ios. How do you install the technology plugin? </P> Fri, 10 Jun 2016 13:58:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-data-from-my-Cisco-switch-into-Splunk/m-p/206398#M40719 jasonpoth 2016-06-10T13:58:57Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-data-from-my-Cisco-switch-into-Splunk/m-p/206399#M40720 <P>The best practice is to use a syslog aggregation tier and then use the Universal Forwarder on top of your syslog server(s). This gives you the most reliability, auto-load balances the data if you have a distributed setup and will not cause data loss if you need to re-start your Splunk infrastructure. I highly recommend you go this route.</P> <P>If you don't have syslog servers then you can syslog directly to Splunk.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Monitornetworkports">http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/Monitornetworkports</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/HowSplunkEnterprisehandlessyslogdata">http://docs.splunk.com/Documentation/Splunk/6.4.1/Data/HowSplunkEnterprisehandlessyslogdata</A></P> Fri, 10 Jun 2016 16:28:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-get-data-from-my-Cisco-switch-into-Splunk/m-p/206399#M40720 shaskell_splunk 2016-06-10T16:28:49Z