Getting Data In

Cisco Anyconnect via Syslog

sbgoldberg13
Explorer

Greetings. This may be elementary, but I have our Cisco ASA 5516 sending logs via a syslog server to Splunk. I configured a basic inputs.conf file to do so.

The logs get into Splunk but the parsing isn't very good. I seem to have to extract most fields (like I saw in another question re: message_id field.) Shouldn't those fields be parsed automatically? I don't see an AnyConnect TA or app except for NVM which my infrastructure team says we're not using.

Any guidance would be much appreciated.

Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

You have to install the Splunk Add-on for Cisco ASA:
https://splunkbase.splunk.com/app/1620/

View solution in original post

0 Karma

woodcock
Esteemed Legend

You have to install the Splunk Add-on for Cisco ASA:
https://splunkbase.splunk.com/app/1620/

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...