Why are there no Traffic logs from Splunk Add-on for Cisco Meraki?

[gordo32]

Recently deployed this add-on, but it doesn't seem to bring back Traffic or URL logs like we did when using the TA-meraki & syslog.

Are these not supported with the API-based mechanism, or is there something I'm missing - like a setting on the Meraki end to include these logs?

Thanks,

Gord T.

[gordo32]

A little more investigation on this, and there appears to be inconsistent information in the Meraki documentation on this. The top row of the table in this document states in the "device flow" information is available via API, but this document list URLs & Flows as Syslog messages, and documents Event Log separately (and I believe ONLY eventlog details are sent to Meraki Cloud).

Can anyone confirm whether Flows and/or URL events are eventually planned? For now, it looks like syslog is my best choice.

[jgeremia]

wanted to chime in and say this is my experience as well. One thing I was going to do for this was set up Splunk connect for syslog and push those logs to it. Splunk Connect for Syslog