All Apps and Add-ons

Technology Add-on for Cisco Secure Access Control Server (ACS): Why am I unable to see any data after installing the add-on?

euroa
Engager

I installed the Technology Add-on for Cisco Secure Access Control Server (ACS) to a heavy forwarder and pointed the Cisco ACS device to send data to the heavy forwarder via udp 9010. I created an inputs.conf file with the following :

[udp://9010]
connection_host = dns
disabled = 0
followTail = 0
sourcetype = cisco:acs
crcSalt = 
index = cisco_secure_acs

and ensured that the port is opened however I am still unable to see any data in the index. Anyone have any ideas?

0 Karma

woodcock
Esteemed Legend

Sniff the port with tcpdump and see if the traffic is getting there. If missing, make sure that the sender is using UDP, not TCP and make sure that ACL/firewall/routes/etc. are allowing the traffic. But you should not be sending directly to Indexers, you should be sending to a syslog aggregator like syslog-ng and doing this:

http://www.georgestarcher.com/splunk-success-with-syslog/

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...