topic Re: TA-meraki Not Logging all Events to Splunk in Getting Data In

TA-meraki Not Logging all Events to Splunk

astackpole — Mon, 16 Nov 2020 21:18:25 GMT

I've successfully installed and configured the TA-meraki app and have all the CIM compliant data coming into Splunk, my question is...why am I not getting all the logs in Splunk that appear in the Meraki Dashboard?

I'm currently receiving events for the following apps/roles in Splunk (below on the right), but when comparing it to the Roles configured on the Meraki-side (to the left), we're not receiving anything from the Security Events Role in Splunk, although it's logging fine into the Meraki dashboard. Any help would be GREATLY appreciated!

Re: TA-meraki Not Logging all Events to Splunk

davidward2829 — Mon, 30 Nov 2020 19:01:54 GMT

hello did you get to the bottom of this ? we have the same issue

Thanks

Dave

Re: TA-meraki Not Logging all Events to Splunk

astackpole — Wed, 13 Jan 2021 21:12:50 GMT

Meraki responded to us stating that not all Meraki logs are designed to be ingested by syslog when you configure the syslog option. So basically, it's expected to see logs in the Meraki dashboard you're not finding in Splunk.

Sorry, I'm sure it's not the answer you were looking for. Hopefully Meraki updates this moving forward!