Getting Data In

Cisco Anyconnect via Syslog

sbgoldberg13
Explorer

Greetings. This may be elementary, but I have our Cisco ASA 5516 sending logs via a syslog server to Splunk. I configured a basic inputs.conf file to do so.

The logs get into Splunk but the parsing isn't very good. I seem to have to extract most fields (like I saw in another question re: message_id field.) Shouldn't those fields be parsed automatically? I don't see an AnyConnect TA or app except for NVM which my infrastructure team says we're not using.

Any guidance would be much appreciated.

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

You have to install the Splunk Add-on for Cisco ASA:
https://splunkbase.splunk.com/app/1620/

View solution in original post

0 Karma

woodcock
Esteemed Legend

You have to install the Splunk Add-on for Cisco ASA:
https://splunkbase.splunk.com/app/1620/

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...