topic Cisco equipement in Splunk in Monitoring Splunk

Cisco equipement in Splunk

inessa40408 — Thu, 02 Jan 2025 14:16:01 GMT

Hello Splunkers 😉

Have any of you worked with log files of Cisco equipment:

- AP 9130

- WiFi Controller 9840

I am interested in how to add more information to log files.

And also: perhaps someone can share a use case for creating dashboards for this equipment.

Thanks in advance for your answers.

Re: Cisco equipement in Splunk

gcusello — Thu, 02 Jan 2025 15:25:49 GMT

Hi @inessa40408 ,

I cannot help you in Cisco network devices configuration, but in Spunk, you can use Cisco network Add-On ( https://splunkbase.splunk.com/app/1467 ) to correctly parse the logs.

usually these logs are ingested configuring the Cisco network devices to send their logs to a Splunk receiver using syslog.

To receive syslog, you can use Splunk network inputs ( https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Monitornetworkports ), if you have few logs,

otherwise you should configure an rsyslog receiver that writes logs in files read by Splunk ( https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Data/Monitorfilesanddirectories ).

For the dashboards they depend on what you need to monitor, anyway the Splunk App for Cisco Network Devices could help you: https://splunkbase.splunk.com/app/1352

Ciao.

Giuseppe

Re: Cisco equipement in Splunk

inessa40408 — Tue, 07 Jan 2025 11:21:15 GMT

Thank you very much for your help! 🙂

Re: Cisco equipement in Splunk

gcusello — Tue, 07 Jan 2025 11:55:01 GMT

Hi @inessa40408 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉