All Apps and Add-ons

Can you install Technology Add-on for Cisco IOS on a universal forwarder?

johns3
Path Finder

I have a Linux syslog server that collects syslog from all of my Cisco and other networking devices and forwards everything off to Splunk with the Universal Forwarder. I would like to use the Cisco IOS for Splunk app but I need to install the Cisco IOS Technology Add-On to convert the log messages to the Cisco type.

Would I be able to install the Cisco IOS TA App on the Universal Forwarder or does it need to be on a light/heaver forwarder?

0 Karma

mikaelbje
Motivator

Hi,

the Technology Add-On cannot be installed on a Universal Forwarder. In fact there is no point in installing it on a UF. A good approach would be the following:

  1. Set up your syslog server to listen on a separate UDP port for Cisco IOS events and log those events to a new directory + hostname on the Syslog server
  2. Set up a Splunk UF to monitor the directory through an inputs.conf file. In the monitor stanza set:
    sourcetype=cisco:ios
  3. Make the UF forward the logs to your indexer.

You can of course use a heavy forwarder but I don't see the point of doing that as you can save CPU cycles by simply using dedicated UDP ports for your different sourcetypes to classify them at an early stage. For devices that aren't able to log syslog to any other port than 514 then you need to set the sourcetype to syslog and use regex to transform to the correct sourcetype.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...