Can you install Technology Add-on for Cisco IOS on a universal forwarder?

[johns3]

I have a Linux syslog server that collects syslog from all of my Cisco and other networking devices and forwards everything off to Splunk with the Universal Forwarder. I would like to use the Cisco IOS for Splunk app but I need to install the Cisco IOS Technology Add-On to convert the log messages to the Cisco type.

Would I be able to install the Cisco IOS TA App on the Universal Forwarder or does it need to be on a light/heaver forwarder?

[mikaelbje]

Hi,

the Technology Add-On cannot be installed on a Universal Forwarder. In fact there is no point in installing it on a UF. A good approach would be the following:

1. Set up your syslog server to listen on a separate UDP port for Cisco IOS events and log those events to a new directory + hostname on the Syslog server
2. Set up a Splunk UF to monitor the directory through an inputs.conf file. In the monitor stanza set:

   sourcetype=cisco:ios

3. Make the UF forward the logs to your indexer.

You can of course use a heavy forwarder but I don't see the point of doing that as you can save CPU cycles by simply using dedicated UDP ports for your different sourcetypes to classify them at an early stage. For devices that aren't able to log syslog to any other port than 514 then you need to set the sourcetype to syslog and use regex to transform to the correct sourcetype.