topic Not able to see the syslogs of ASA on Splunk Web in Getting Data In

Not able to see the syslogs of ASA on Splunk Web

dineshverma — Wed, 08 Nov 2017 18:05:07 GMT

Hi All,

I've configured my ASA to send syslog to splunk server installed on centos. I took capture on ASA and I can see packets are leaving the ASA. I took capture on centOS on port 514 and packets are making to the centOS machine as well. For some reason I don't see them on splunk web.

I've created data input for UDP port 514 (all default), Source type (cisco:asa).

I'm really not sure what is the piece of info or config I'm missing here.

I would appreciate your quick help here.

Regards,
Dv

Re: Not able to see the syslogs of ASA on Splunk Web

xavierashe — Wed, 08 Nov 2017 20:01:26 GMT

What are you using to capture the syslog packets on the linux box? syslogd, rsyslog, syslog-ng, or splunk?

Re: Not able to see the syslogs of ASA on Splunk Web

molinarf — Wed, 08 Nov 2017 20:44:06 GMT

Are you looking to get data from your firewall for security events? If this is the case, you will need to install the Splunk for Cisco Security App which will provide a dashboard that contains Security Event Statistics, as well as being able to look at a Firewall Overview or Event Search.