Can the Cisco Network App for Splunk Enterprise use input from Syslog-ng instead of having Splunk as a syslog target?

[markschoonover]

Thanks for reading. We use Syslog-NG for our Cisco devices to push syslog messages to. I've read the directions on installation and the help file states Cisco devices need to have Splunk as a syslog target. Can the app use input from syslog-ng instead? If so, how would this be configured?

[mikaelbje · Accepted solution]

Sure, just set up a monitor stanza to read the log files generated by syslog-ng.

I.e.
[monitor:///var/log/remote/cisco_ios/*/syslog]
host_segment = 5
sourcetype = cisco:ios

If the logs are not already identified as IOS events and placed in their own directory such as in the example, replace sourcetype = cisco:ios with sourcetype = syslog
The Add-on will then take care of changing the sourcetype