Archive

Cisco Firewall add-on change data-source

New Member

Hello,

I'm new to splunk and I'd like to use this app with a file as data input and not a port on the splunk server. I'm already running an instance of rsyslog and I don't want splunk to retrieve log directly. How can I do this (if possible)?

Simon

0 Karma

SplunkTrust
SplunkTrust

You can add your files that rsyslog is storing to a "monitor://" stanza in $SPLUNK_HOME/etc/system/local/inputs.conf, just use the same sourcetype as the Cisco Firewall app is expecting. This would look something like:

[monitor:///var/log/firewalls]
sourcetype=cisco_firewall

Splunk Employee
Splunk Employee
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!