How the ASA logs are fed to Splunk for Cisco ASA

harshal_chakran · ‎04-29-2014

Hi,
I wanted to know how the ASA logs/ PIX logs from Cisco devices are fed to Splunk for Cisco ASA app? Can we use the TCP port for uploading?
Can anybody also share a sample ASA logs so that I can gain knowledge about its structure and try to run the app,as I am unable to get the sample files on web.

Please Help...!!!

jconger · ‎05-13-2014

You can deliver ASA logs to either a Splunk index or a Splunk Universal Forwarder (which will then forward data to the Splunk index). Here is the command to configure your device:

logging host <int> <ipaddr> tcp/514

The field is the interface that the syslog data will be sent out of. The field is the IP address of your syslog collector. If you configured a different TCP port from the standard 514, then use that in this command instead. Remember to commit the changes.

Also, there are sample logs within the add-on located in the samples directory.

How the ASA logs are fed to Splunk for Cisco ASA

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Are you a member of the Splunk Community?

How the ASA logs are fed to Splunk for Cisco ASA

Thanks for the Memories! Splunk University, .conf25, and our Community

Data Persistence in the OpenTelemetry Collector

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever