topic Re: How to send syslog to sandbox? in Getting Data In

How to send syslog to sandbox?

vashidu — Mon, 08 Sep 2014 12:25:20 GMT

How can i send syslog from my cisco asa to the splunk sandbox?

Re: How to send syslog to sandbox?

MuS — Mon, 28 Sep 2020 17:30:52 GMT

Take a look at the Cisco Docs http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/monitor_syslog.html#pgfId-1552182

After that you enable network inputs in Splunk http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Monitornetworkports

cheers, MuS

Re: How to send syslog to sandbox?

vashidu — Mon, 08 Sep 2014 15:17:14 GMT

the linked document doesnt cover splunk cloud.

Re: How to send syslog to sandbox?

MuS — Mon, 08 Sep 2014 15:19:24 GMT

well you did not mention Splunk cloud at all 😉

Re: How to send syslog to sandbox?

MuS — Mon, 08 Sep 2014 15:23:26 GMT

but because you were so keen and provided a lot of information, I was able to find the correct link http://docs.splunk.com/Documentation/Storm/latest/User/AdddataoverTCPorUDP

this includes a lot irony 😉

Re: How to send syslog to sandbox?

vashidu — Mon, 08 Sep 2014 18:21:09 GMT

My cloud splunk must be missing a part of that then. Cant find that anywhere.

Re: How to send syslog to sandbox?

MuS — Mon, 08 Sep 2014 18:51:35 GMT

Login to splunkstorm.com, select your project, click the data tab, under network data click select, then click authorize your IP address - done

Re: How to send syslog to sandbox?

fortiwhall — Thu, 16 Oct 2014 18:36:54 GMT

It looks like Splunk Sandbox (which I believe is different than splunk storm or cloud) only supports uploading data via files. In the Splunk Sandbox instance I just spun up, the only "Add Data" option is to upload a file. I was also wanting to send some live SYSLOG from some of my devices up to the Sandbox, but it appears the only way to really do this is to log to your own server somewhere, take the log files, and then upload them to Sandbox.

Splunk sandbox is currently available off the front page of Splunk by clicking "Free Splunk" and then clicking the Free Online Sandbox link.
This is the direct link http://www.splunk.com/page/sign_up/cloudtrial?redirecturl=/getsplunk/cloudtrial&ac=test_modal_onlinesandbox

Re: How to send syslog to sandbox?

ChrisG — Thu, 16 Oct 2014 19:02:02 GMT

This is correct. The online sandbox only supports file upload, not forwarding or monitoring.

Re: How to send syslog to sandbox?

cgaspard_splunk — Thu, 08 Jan 2015 18:16:37 GMT

Currently Splunk Sandbox DOES support forwarding data via Universal Forwarders.

On the other hand, raw UDP SYSLOG forwarding directly to the Sandbox (without a Universal Forwarder) is not supported. This is done for good reasons. To forward SYSLOG data from a host, a Universal Forwarder can be installed and configured to monitor and push local SYSLOG to the Sandbox.