Getting Data In

Cisco logs though Heavy Forwarder

tmardan
Explorer

Hello!

I'm trying to collect logs from Cisco ASA devices through Heavy Forwarder, I'm sending all Cisco ASA logs to my HF instance and then send them to indexers.

I want to parse these logs and send to indexers only VPN-event logs. How can I filter them?

Can I filter them using event types from Cisco Add-on?

Labels (1)
Tags (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Hi
Here is example how filter ASA logs https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-ASA-syslogs-before-indexing-to-avoi...
You must update it based on what you want exactly filter out.
And you must do those filtering on HF not Indexers.
r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust
Hi
Here is example how filter ASA logs https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-ASA-syslogs-before-indexing-to-avoi...
You must update it based on what you want exactly filter out.
And you must do those filtering on HF not Indexers.
r. Ismo
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...