topic Re: Does Splunk support capturing data from CA Layer7 and how? in Getting Data In

Does Splunk support capturing data from CA Layer7 and how?

Phranquelyn — Tue, 09 Feb 2016 20:00:09 GMT

Layer7 was acquired by CA and is offered as an API Management Platform. It seems that Layer7 should be able to send log data to a Syslog server and have a Splunk forwarder capture and send to the Splunk indexer. Does anyone have any further details about support for this?

Re: Does Splunk support capturing data from CA Layer7 and how?

cafissimo — Wed, 24 Feb 2016 11:19:49 GMT

Hello,
I managed to install splunk universal forwarder 6.3.0 on Layer7 appliances and to send Layer7 "api logs" to Splunk indexers.
There is nothing special to configure on Layer7 appliances.

Re: Does Splunk support capturing data from CA Layer7 and how?

dimitryz — Mon, 09 Jul 2018 08:10:22 GMT

Hello,
CA not exactly supports installing universal forwarder on their appliance.
But it always possible to set a syslog on CA API Gateway and point it to Heavy Forwarder or Indexer - depending on your configuration.

Syslog is set by using Log Sink Properties :setting type as syslog and setting splunk host:port in syslog settings.
Important :
You have to set at least one category - Audit ,for example and at least one additional filter - for example Service Name .
Splunk setting are pretty standard - TCP Data input (UDP is also supported by Layer 7 ) ,port (for example 514) ,source type(syslog or any proper source type) host and index.