Adding cisco switches, (all kinds), to syslog to Splunk

[rmcole]

I've tried adding a new UDP data input but it feels like something is missing. I went as far as to cause events on a switch that should normally be sent to a syslog server (Splunk in this case). I am very new to the management side of Splunk so please speak simple.

Ok, I give up. Splunk is one of 1000 things I do and I'm tired of wasting time messing with it.
There's got to be something better out there!

[dshpritz · Accepted solution]

If the events are showing up in Splunk, then your next step is to get some field extractions for the data. You're in luck, there is a Technology Add-on for Cisco IOS, which should get you a pretty good start. Then start exploring your data.

[dshpritz]

Have you looked at the docs on field extractions? http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime

The TA that I linked to should provide some out of the box extractions, but it would also depend on what the sourcetype of your incoming data is. Is the data currently sourcetyped as syslog?