Hello,
I currently have numerous Cisco devices sending syslog to my Splunk Server (Under Search > Data Summary and manually select each IP). I have installed the Cisco IOS App and the Cisco Security Suite App. However, none of the Cisco data displays in there at all. When I select Devices, it shows 0. Essentially I would like to have a dashboard page that displays all of the devices on it. Is there a way to complete this and setup a dashboard page allowing you to drill down into each device, rather than have to manually check each Cisco device from Searching and Reporting > Data Summary > Select the IP to view to Syslog messages? Thanks.
I'm the author of the Cisco IOS app. You need both the Cisco IOS app and the Technology Add-On for Cisco IOS on your server. The Tech addon also needs to be installed on your indexer if you have a dedicated indexer. The syslog UDP input needs to have sourcetype set to "syslog" or "cisco:ios". This is documented in the README file that comes with the app as well as in the docs on Splunk Apps.
The Cisco IOS app has nothing to do with the Cisco Security Suite which covers other Cisco apps and is developed by Splunk.
Please rate my answer if you find it helpful.
Regards,
Mikael
I'm the author of the Cisco IOS app. You need both the Cisco IOS app and the Technology Add-On for Cisco IOS on your server. The Tech addon also needs to be installed on your indexer if you have a dedicated indexer. The syslog UDP input needs to have sourcetype set to "syslog" or "cisco:ios". This is documented in the README file that comes with the app as well as in the docs on Splunk Apps.
The Cisco IOS app has nothing to do with the Cisco Security Suite which covers other Cisco apps and is developed by Splunk.
Please rate my answer if you find it helpful.
Regards,
Mikael
Hi Mikael,
I'm currently facing an issue with Cisco IOS app : i've created UDP input (port 514) having cisco:ios sourcetype set.
Everything works fine for about 2 weeks, but then all logs from the search are getting reassigned with source /var/log/syslog-ng/syslog-ng.log and sourcetype syslog (default) instead of udp:514 and cisco:ios respectively.
This drops all the additional info provided by cisco ios app from the logs.
I have to disable and re-enable my udp input and then it works fine again for the same period of time.
Can you please give me a direction to troubleshoot this?
Regards,
Oleg.
Thanks much Mikael, that seems to be pulling all of the data into the Cisco IOS App