Getting Data In

Error while adding more than 1 Cisco device

jfk87
New Member

Dear Experts, 

I am trying to add the data to monitor Cisco logs through Splunk, i am just able to add 1 device only, it is giving error when i am adding more devices.

Snapshot of the error is shown below.

Any help regarding this will be appreciated.

jfk87_0-1617622559625.png

 

Labels (1)
0 Karma

jfk87
New Member

Will be thankful if there is any help regarding this

 

0 Karma

brentw
Splunk Employee
Splunk Employee

Hello there. Consider using  Splunk Connect for Syslog. It is a tool that will allow very easy implementation of datasources like Cisco through syslog-ng. It will ultimately write to HTTP Event Collector in Splunk.

See this link for additional information. I hope this helps because I have been having great success with this tool!

jfk87
New Member

Thanks, have to check it.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It would help if you explained the steps to reproduce this problem, but I suspect you are doing at least two things wrong:

1) Trying to send syslog events directly to Splunk.  This has been discouraged for a few years because it can lead to data loss.  Best Practice is to send syslog events to a dedicated syslog server and forward them from there to Splunk.

2) Assuming there is a one-to-one relationship between a UDP port and a network device.  This is not the case.  Once Splunk is listening to a port, it will accept data from thousands of devices, provided they match the "Only accept connection from" setting.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jfk87
New Member

It can be reproduce by doing the following, 

Add Data > Monitor > TCP/UDP > then mention the port udp/514 and add any IP address in Only accept connection from field.

It is just accepting one device, and when i am trying to add another device, it is showing an error, as was mentioned in the snap in my last post.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you read point #2 in my answer?  It doesn't make sense to add the same port multiple times.  Once Splunk is listening to a port there is no need to tell it to do so again.

Please describe the problem you are trying to solve.  What is it that adding another port 514 input will do for you?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...