How the ASA logs are fed to Splunk for Cisco ASA

[harshal_chakran]

Hi,
I wanted to know how the ASA logs/ PIX logs from Cisco devices are fed to Splunk for Cisco ASA app? Can we use the TCP port for uploading?
Can anybody also share a sample ASA logs so that I can gain knowledge about its structure and try to run the app,as I am unable to get the sample files on web.

Please Help...!!!

[jconger]

You can deliver ASA logs to either a Splunk index or a Splunk Universal Forwarder (which will then forward data to the Splunk index). Here is the command to configure your device:

logging host <int> <ipaddr> tcp/514

The field is the interface that the syslog data will be sent out of. The field is the IP address of your syslog collector. If you configured a different TCP port from the standard 514, then use that in this command instead. Remember to commit the changes.

Also, there are sample logs within the add-on located in the samples directory.