Getting Data In
Highlighted

Are there additional considerations for onboarding Cisco ASA data into Splunk?

Path Finder

I apologize in advance if this is an extremely basic question, but I need to be sure I do this correctly.

I'm researching how to onboard Cisco ASA data into Splunk for my internship. I'm reading through the documentation here on how to get the data into Splunk, but I'm curious. Are there any additional considerations I should take when getting ASA into Splunk, or is the process the same as with any other device?

Here is the document I'm reading:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Data/WhatSplunkcanmonitor

If there is other documentation you think I should read, please let me know.

Thank you.

0 Karma
Highlighted

Re: Are there additional considerations for onboarding Cisco ASA data into Splunk?

SplunkTrust
SplunkTrust

Yes, it's probably all you need. But no, you might need (or at least want) just a bit more. Oh, don't you love these "Maybe, Maybe Not?" answers?

If you want to get ASA data into Splunk then you likely need go no further than the above mentioned docs. You might have to do a little searching for specific issues (if any come across), but those will likely be all you need.

If you are truly trying to understand the data, you'll want to refer to Cisco's documentation on their various event ids. This Cisco Syslog Message guide could be useful or maybe this PDF version of same. If those aren't right, use your favorite search engine and search for "Cisco syslog events".

You don't have to memorize them or anything. Many or even most events are pretty straightforward. But occasionally you may want to look up the difference between two events, both with nearly the same data (or what appears to be the same data in different format), to see exactly what difference there is between them - might be a good opportunity to not send one of them in and save license. Or sometimes there's just an extra piece in the data you don't know what it is, so looking it up can be good.

Happy Splunking!
-Rich

View solution in original post

Highlighted

Re: Are there additional considerations for onboarding Cisco ASA data into Splunk?

Path Finder

Thank you very much! Sorry for taking so long to accept this.

0 Karma