All Apps and Add-ons

Can you install Technology Add-on for Cisco IOS on a universal forwarder?

johns3
Path Finder

I have a Linux syslog server that collects syslog from all of my Cisco and other networking devices and forwards everything off to Splunk with the Universal Forwarder. I would like to use the Cisco IOS for Splunk app but I need to install the Cisco IOS Technology Add-On to convert the log messages to the Cisco type.

Would I be able to install the Cisco IOS TA App on the Universal Forwarder or does it need to be on a light/heaver forwarder?

0 Karma

mikaelbje
Motivator

Hi,

the Technology Add-On cannot be installed on a Universal Forwarder. In fact there is no point in installing it on a UF. A good approach would be the following:

  1. Set up your syslog server to listen on a separate UDP port for Cisco IOS events and log those events to a new directory + hostname on the Syslog server
  2. Set up a Splunk UF to monitor the directory through an inputs.conf file. In the monitor stanza set:
    sourcetype=cisco:ios
  3. Make the UF forward the logs to your indexer.

You can of course use a heavy forwarder but I don't see the point of doing that as you can save CPU cycles by simply using dedicated UDP ports for your different sourcetypes to classify them at an early stage. For devices that aren't able to log syslog to any other port than 514 then you need to set the sourcetype to syslog and use regex to transform to the correct sourcetype.

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...