Deployment Architecture

How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

manmah4u
Explorer

Hello,

I have been working on Splunk for some time and have seen its use for server/application monitoring. I have been assigned with a task to index logs from Network devices (Routers,firewalls,IPS etc). The challenge over here is I absolutely have no idea how to configure hardware devices in my splunk environment consisting of 5 indexers, 2 search heads, 1 deployment server. I do understand that there would be ways for forwarding logs from network devices (syslog capability) to push logs to Splunk, but I'm confused about configurations to be made in splunk (as in indexer, forwarder, search head). Any pointers as in documents, Google links would help.

fdi01
Motivator

see this two link it can help you:

1-) http://answers.splunk.com/answers/4309/

2-) http://answers.splunk.com/answers/50082/

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this link:
http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor

see this ex:

/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index  your_index_name  -sourcetype %app% 

Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

0 Karma

manmah4u
Explorer

Thanks for swift Response, but what I'm looking is inputs.conf configurations in splunk to monitor logs from network devices in particular

0 Karma

fdi01
Motivator

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this ex:
/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index your_index_name -sourcetype %app% Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

0 Karma

fdi01
Motivator

first see this link : http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor
to inputs.conf configurations in splunk to monitor logs from network devices in particular

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...