Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- Re: Cisco IOS and Cisco Security Suite: Why Cisco ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
I currently have numerous Cisco devices sending syslog to my Splunk Server (Under Search > Data Summary and manually select each IP). I have installed the Cisco IOS App and the Cisco Security Suite App. However, none of the Cisco data displays in there at all. When I select Devices, it shows 0. Essentially I would like to have a dashboard page that displays all of the devices on it. Is there a way to complete this and setup a dashboard page allowing you to drill down into each device, rather than have to manually check each Cisco device from Searching and Reporting > Data Summary > Select the IP to view to Syslog messages? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm the author of the Cisco IOS app. You need both the Cisco IOS app and the Technology Add-On for Cisco IOS on your server. The Tech addon also needs to be installed on your indexer if you have a dedicated indexer. The syslog UDP input needs to have sourcetype set to "syslog" or "cisco:ios". This is documented in the README file that comes with the app as well as in the docs on Splunk Apps.
The Cisco IOS app has nothing to do with the Cisco Security Suite which covers other Cisco apps and is developed by Splunk.
Please rate my answer if you find it helpful.
Regards,
Mikael
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm the author of the Cisco IOS app. You need both the Cisco IOS app and the Technology Add-On for Cisco IOS on your server. The Tech addon also needs to be installed on your indexer if you have a dedicated indexer. The syslog UDP input needs to have sourcetype set to "syslog" or "cisco:ios". This is documented in the README file that comes with the app as well as in the docs on Splunk Apps.
The Cisco IOS app has nothing to do with the Cisco Security Suite which covers other Cisco apps and is developed by Splunk.
Please rate my answer if you find it helpful.
Regards,
Mikael
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Mikael,
I'm currently facing an issue with Cisco IOS app : i've created UDP input (port 514) having cisco:ios sourcetype set.
Everything works fine for about 2 weeks, but then all logs from the search are getting reassigned with source /var/log/syslog-ng/syslog-ng.log and sourcetype syslog (default) instead of udp:514 and cisco:ios respectively.
This drops all the additional info provided by cisco ios app from the logs.
I have to disable and re-enable my udp input and then it works fine again for the same period of time.
Can you please give me a direction to troubleshoot this?
Regards,
Oleg.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks much Mikael, that seems to be pulling all of the data into the Cisco IOS App
Observe and Secure All Apps with Splunk
Splunk Decoded: Business Transactions vs Business IQ
Fastest way to demo Observability
