topic Set up universal forwarder on Cisco FTD in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Set-up-universal-forwarder-on-Cisco-FTD/m-p/383622#M69069 <P>I am running Splunk Enterprise for Windows 7.1.3 and am trying to index Cisco FTD logs. I understand that the eStreamer will not work on a Windows platform; but, I am receiving data into the Cisco FTD dashboard from a Cisco ASA device. I believe that if I ensure a universal forwarder is properly configured on on the FTD, and the correct TCP forwarder connection is established, I can get data from the forwarder into the app.<BR /> My questons are:<BR /> Are there any .conf files on the forwarder that require modification?<BR /> What Server Class should I use for the FTD and what ports should be configured? (I'm reasonably certain this should be 8089, but will listen to any and all other opinions.)<BR /> Is there any step I am missing?<BR /> The firewall team would love to have this work.<BR /> Thanks<BR /> Ron Jones</P> Thu, 14 Feb 2019 20:36:57 GMT noy72 2019-02-14T20:36:57Z Set up universal forwarder on Cisco FTD https://community.splunk.com/t5/Getting-Data-In/Set-up-universal-forwarder-on-Cisco-FTD/m-p/383622#M69069 <P>I am running Splunk Enterprise for Windows 7.1.3 and am trying to index Cisco FTD logs. I understand that the eStreamer will not work on a Windows platform; but, I am receiving data into the Cisco FTD dashboard from a Cisco ASA device. I believe that if I ensure a universal forwarder is properly configured on on the FTD, and the correct TCP forwarder connection is established, I can get data from the forwarder into the app.<BR /> My questons are:<BR /> Are there any .conf files on the forwarder that require modification?<BR /> What Server Class should I use for the FTD and what ports should be configured? (I'm reasonably certain this should be 8089, but will listen to any and all other opinions.)<BR /> Is there any step I am missing?<BR /> The firewall team would love to have this work.<BR /> Thanks<BR /> Ron Jones</P> Thu, 14 Feb 2019 20:36:57 GMT https://community.splunk.com/t5/Getting-Data-In/Set-up-universal-forwarder-on-Cisco-FTD/m-p/383622#M69069 noy72 2019-02-14T20:36:57Z