How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

[manmah4u]

Hello,

I have been working on Splunk for some time and have seen its use for server/application monitoring. I have been assigned with a task to index logs from Network devices (Routers,firewalls,IPS etc). The challenge over here is I absolutely have no idea how to configure hardware devices in my splunk environment consisting of 5 indexers, 2 search heads, 1 deployment server. I do understand that there would be ways for forwarding logs from network devices (syslog capability) to push logs to Splunk, but I'm confused about configurations to be made in splunk (as in indexer, forwarder, search head). Any pointers as in documents, Google links would help.

[fdi01]

see this two link it can help you:

1-) http://answers.splunk.com/answers/4309/

2-) http://answers.splunk.com/answers/50082/

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this link:
http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor

see this ex:

/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index  your_index_name  -sourcetype %app% 

Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

[manmah4u]

Thanks for swift Response, but what I'm looking is inputs.conf configurations in splunk to monitor logs from network devices in particular

[fdi01]

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this ex:
/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index your_index_name -sourcetype %app% Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

[fdi01]

first see this link : http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor
to inputs.conf configurations in splunk to monitor logs from network devices in particular