index=network_syslog sourcetype=syslog
results are displayed
index=network_syslog sourcetype=syslog eventtype="cisco_ios-ipsla" | eval state=case(state_to == "Up", 1, state_to == "Down", -1) | strcat dvc " " ip_sla_id dvc_ip_sla_id | timechart avg(state) AS state BY dvc_ip_sla_id | fillnull value=0 no results founds
Do we need to configure anything on routers or network devices?
To begin collecting data from Cisco devices, you must minimally enable a network input to receive data and configure the cisco device to send syslog to the Splunk instance (or forwarder). If you are using the Cisco Security Suite, there are detailed instructions on how to turn on data for the Cisco devices in addition to enabling Splunk to receive and recognize the data.
To begin collecting data from Cisco devices, you must minimally enable a network input to receive data and configure the cisco device to send syslog to the Splunk instance (or forwarder). If you are using the Cisco Security Suite, there are detailed instructions on how to turn on data for the Cisco devices in addition to enabling Splunk to receive and recognize the data.
If you run index=network_syslog sourcetype=syslog
can you confirm that "eventtype" is indeed being set and that at least some of them are set to "cisco_ios-ipsla"?
Nope I dont see any events with cisco_ios*
I was asked to install cisco add on app on indexers which I am yet to do. Will keep you posted if results are changed after doing it
Hi -
Hope you have followed below link -
http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Monitornetworkports