topic Re: ingesting Cisco logs from kiwi syslog server in Getting Data In

ingesting Cisco logs from kiwi syslog server

afolabia — Thu, 06 Feb 2020 21:21:03 GMT

I've my cisco devices sending the logs to kiwi syslog server and writing them to several files, (ise,switches,asa...). I need to monitor and ingest the data. Which servers do I setup the monitoring on? I've 1 search,deployment,indexer,HF each.

Re: ingesting Cisco logs from kiwi syslog server

harsmarvania57 — Thu, 06 Feb 2020 22:04:43 GMT

Hi,

On your Kiwi Syslog Server (which is writing Cisco logs to different files), install splunk universal forwarder and start monitoring those different file.

For different type of data parsing, you may need to install various Splunk apps/add-ons on Indexer OR Heavy Forwarder and Search Head.

Re: ingesting Cisco logs from kiwi syslog server

afolabia — Thu, 06 Feb 2020 22:44:17 GMT

thanks, but I'm trying to find out which one of my server will be more suitable or recommended to create the setup of the add data? I already have the UF on the syslog server and the cisco app and addon installed and my output.conf, but didn't find any doc about where to configure the add data setup.

Re: ingesting Cisco logs from kiwi syslog server

harsmarvania57 — Thu, 06 Feb 2020 22:48:48 GMT

Universal Forwarder will send data to Indexer and Search Head will search those data from Indexer