All Apps and Add-ons

Can you install Technology Add-on for Cisco IOS on a universal forwarder?

Path Finder

I have a Linux syslog server that collects syslog from all of my Cisco and other networking devices and forwards everything off to Splunk with the Universal Forwarder. I would like to use the Cisco IOS for Splunk app but I need to install the Cisco IOS Technology Add-On to convert the log messages to the Cisco type.

Would I be able to install the Cisco IOS TA App on the Universal Forwarder or does it need to be on a light/heaver forwarder?

0 Karma



the Technology Add-On cannot be installed on a Universal Forwarder. In fact there is no point in installing it on a UF. A good approach would be the following:

  1. Set up your syslog server to listen on a separate UDP port for Cisco IOS events and log those events to a new directory + hostname on the Syslog server
  2. Set up a Splunk UF to monitor the directory through an inputs.conf file. In the monitor stanza set:
  3. Make the UF forward the logs to your indexer.

You can of course use a heavy forwarder but I don't see the point of doing that as you can save CPU cycles by simply using dedicated UDP ports for your different sourcetypes to classify them at an early stage. For devices that aren't able to log syslog to any other port than 514 then you need to set the sourcetype to syslog and use regex to transform to the correct sourcetype.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...