Getting Data In

how to collect log

priyohw
Explorer

I install splunk in my windows server 2008, collecting log from windows working fine.
I need some help to collect log from solaris 10 and cisco device.
what should i do?

please help me.

Tags (2)
0 Karma

priyohw
Explorer

Thank you for this answer,
i will try it as your suggestion.

0 Karma

MHibbin
Influencer

Ok if this does work, can you mark the answer as accepted, as this will help tell the community that your question does not need answering, and it also helps those looking for answers.

0 Karma

MHibbin
Influencer

If the files you are looking for Splunk to collect are stored locally, you will probably need to install a Lightweight Forwarder (LF) or a Universal Forwarder (UF) on the device you wish to collect from (i.e. the Solaris 10 machines). You can find information on these here. And the UF download here, and for LF it is a normal Splunk install, but you will need to follow the guide here.

With the cisco devices you are probably best monitoring the network ports (e.g. syslog), you can use the following guide for setting up this, here.

Please note these guides are all part of the Distributed Deployment Manual, which is very useful. You will just need to make sure that for some parts you are using unique ports to avoid conflict with traffic.

Regards,

saurabh_tek
Communicator

The given links are not working @MHibbin.
Could you please share correct links.

0 Karma

kristian_kolb
Ultra Champion

Hi,

For your Solaris box(es), I suggest you use forwarders that you install on the hosts. For Cisco devices (appliances?) syslog is probably the way to go. If you already have an existing syslog server to which you send the Cisco logs, you could install a forwarder there, otherwise you can set up Splunk to act as a syslog server, and configure the Cisco devices to send the logs directly to Splunk.

For more information, please see the documentation for "Getting Data In":

http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/WhatSplunkcanmonitor

hope this helps,

kristian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...