Deployment Architecture
Highlighted

How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Explorer

Hello,

I have been working on Splunk for some time and have seen its use for server/application monitoring. I have been assigned with a task to index logs from Network devices (Routers,firewalls,IPS etc). The challenge over here is I absolutely have no idea how to configure hardware devices in my splunk environment consisting of 5 indexers, 2 search heads, 1 deployment server. I do understand that there would be ways for forwarding logs from network devices (syslog capability) to push logs to Splunk, but I'm confused about configurations to be made in splunk (as in indexer, forwarder, search head). Any pointers as in documents, Google links would help.

Highlighted

Re: How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Motivator

see this two link it can help you:

1-) http://answers.splunk.com/answers/4309/

2-) http://answers.splunk.com/answers/50082/

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this link:
http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor

see this ex:

/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index  your_index_name  -sourcetype %app% 

Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

0 Karma
Highlighted

Re: How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Explorer

Thanks for swift Response, but what I'm looking is inputs.conf configurations in splunk to monitor logs from network devices in particular

0 Karma
Highlighted

Re: How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Motivator

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this ex:
/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index your_index_name -sourcetype %app% Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

0 Karma
Highlighted

Re: How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

Motivator

first see this link : http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor
to inputs.conf configurations in splunk to monitor logs from network devices in particular

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.