topic Re: Splunk for Cisco ASA not show Data in Getting Data In

Splunk for Cisco ASA not show Data

edroche — Fri, 22 Feb 2013 22:34:46 GMT

Installed Splunk for ASA, install Google Maps, Sideview Utilities and TA-cisco_asa. I have confirmed that log from my ASA 5510 are being indexed. What should I be looking at? I am new to Splunk and would really like to get this working. Any thoughts or ideas are appreciated.

Thanks
Ed

Re: Splunk for Cisco ASA not show Data

jcoates_splunk — Sat, 04 Oct 2014 22:08:19 GMT

in the interest of posting something on an old topic... here's how this works:

1) you feed the data into a splunk index (Splunk > Add Data > open a network listener where Cisco or syslog is sending stuff, or start looking at a directory where a syslog server is writing files)

2) at that point you can search the data using Splunk's search language, or try out a prebuilt app that expects this kind of data.

3) You can also try using an add-on that models the data to the Splunk Common Information Model app, which lets you use Search -> Pivot to easily build searches or see the data in apps built for CIM.

Re: Splunk for Cisco ASA not show Data

clucca3 — Fri, 03 Jun 2016 13:52:15 GMT

I downvoted this post because does not address my specific question