All Apps and Add-ons

Can the Cisco Network App for Splunk Enterprise use input from Syslog-ng instead of having Splunk as a syslog target?

markschoonover
Explorer

Thanks for reading. We use Syslog-NG for our Cisco devices to push syslog messages to. I've read the directions on installation and the help file states Cisco devices need to have Splunk as a syslog target. Can the app use input from syslog-ng instead? If so, how would this be configured?

1 Solution

mikaelbje
Motivator

Sure, just set up a monitor stanza to read the log files generated by syslog-ng.

I.e.
[monitor:///var/log/remote/cisco_ios/*/syslog]
host_segment = 5
sourcetype = cisco:ios

If the logs are not already identified as IOS events and placed in their own directory such as in the example, replace sourcetype = cisco:ios with sourcetype = syslog
The Add-on will then take care of changing the sourcetype

View solution in original post

0 Karma

mikaelbje
Motivator

Sure, just set up a monitor stanza to read the log files generated by syslog-ng.

I.e.
[monitor:///var/log/remote/cisco_ios/*/syslog]
host_segment = 5
sourcetype = cisco:ios

If the logs are not already identified as IOS events and placed in their own directory such as in the example, replace sourcetype = cisco:ios with sourcetype = syslog
The Add-on will then take care of changing the sourcetype

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!