I have the Cisco ASA Firewall device sending syslog messages to tcp/udp port 5514 on the Splunk server. These syslog messages are taking up over 100gb on /var/log and they are also getting indexed in $SPLUNK_DB/cisco_asa/db with a max index size of 50gb for the Splunk_CiscoSecuritySuite app on the same Splunk server. How can I safely delete the /var/log messages without affecting the cisco_asa index?
As per the mentioned setup if Splunk is listening on port 5514 there should be nothing in /var/log related to syslog steam coming from Cisco firewall, all received logs will be stored in Splunk index at this location $SPLUNK_DB/cisco_asa/db
