SG500 Logging

[cbruder239]

I have two Cisco SG500 switches and I'd like to get them logging to splunk. What is the best method? I can't find a premade dashboard, nor source connector when adding a port.

[gcusello]

Hi cbruder239,
you have to put Splunk in waiting on 514 port, UDP protocol and then configure your switch to send logs to your Indexer using syslog.
Put attention on two points:

• choose the most suitable Cisco SG500 log level for your scope (I don't know your requirements), eventually make some tries with different log levels;
• using syslog you must always have a Splunk server in waiting, otherwise you loose syslogs, so, if you have the requirement not loosing any log, you have to use two indexers (or two heavy forwarders) and a load balancer to receive logs.

Bye.
Giuseppe