Getting Data In

Cisco ASA 5510 - cannot get data

New Member

I´ve installed Splunk App for Cisco ASA version 0.9.6 downloaded today, and cannot see any data.
Cisco is generating syslog and I´ve configured source as syslog over UDP but nothing is shown on app page.
Do you have a conf guide or some useful info that you can send?

Tags (1)
0 Karma


For starters, are you sure the UDP events are making it into Splunk? I would probably start out with checking some of the following:

  • What port# do you have Splunk set to listen on? If it's < 1024 Splunk needs to be running as root. Check output of (on linux) netstat -anup to make sure it is listening. You may have another process (rsyslog/syslog-ng/etc) already listening on the default UDP syslog port.
  • Use tcpdump to make sure the UDP packets from the ASA are arriving at the Splunk server, on the port you expect them on.
  • If Splunk is listening on the right port and the packets are arriving at the splunk host, is the local host's firewall blocking the udp events?
  • Run a realtime search on "*" and see if you can see these events showing up, perhaps under an unexpected sourcetype

If Splunk is definitely getting the events, then there may be other problems. But you need to make sure the data is getting there first.

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out &gt;&gt; &#x1f3c6; Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...