Has anyone managed to get northbound notifications to be sent from Cisco Prime to Splunk?

[issdevt]

Hello

I testing Splunk and have it set up to receive syslog from various Cisco Wireless controllers and AP's but am having issues with trying to get our Cisco Prime management platform to send information about alarms etc. to Splunk.

I know the data is being sent, as Splunk is showing the traffic being received on port 162 but the data looks like this:

0\x82\xB8public\xA7\x82\xA9AQ\xB5

host = (correct name)  source = 162   sourcetype = snmpv2  timestamp = none

Has anyone managed to get Northbound notifications to be sent from Prime to Splunk? I am obviously missing something, but am not quite sure what

thank you for any guidance

regards

Bryn

[stealthby]

Hello Bryn,

Can you please direct me to any resource to help me set up to receive syslog from Cisco Wireless controllers and AP's. I'm new to Wireless and Splunk any help would be appreciated.

Cheers,

[mikaelbje · Accepted solution]

Hi Bryn,

The northbound notifications are in fact SNMP traps. If you want to receive SNMP in Splunk you will need the SNMP modular input add-on from apps.splunk.com

I would honestly advise against dealing with SNMP in Splunk. What I'd instead suggest is to read up on the Cisco Prime Infrastructure REST API which allows you to poll for device info, alarms and more. There is a Splunk add-on called REST Modular Input which allows you to get this data from CPI using the API reference.

I want to let you know that I'm working on a CPI add-on for Splunk which will support polling device info, primarily to complement my Cisco Networks app and add-on. More features may be added.

[issdevt]

Thank you for that really informative comment...REST API is not something I was aware of and I'll look into that

[mikaelbje]

You're welcome. Please accept my answer by ticking the check icon if you feel you got the answer you were looking for.

If you're struggling to find the PI REST API reference, log in to your CPI server and click on the little help icon with a question mark in it near the top right corner. You'll see a reference to "API Reference". I'm not 100% sure about the wording.

[issdevt]

Mikaelbje...once again, thank you the direction, I am now getting data in from Prime using the REST API and the Splunk add-on

[mikaelbje]

Oh, if you want to test the work in progress CPI add-on check this link: https://github.com/inspired/TA-cisco_prime_infrastructure

Modify local/inputs.conf for your server, username and password. Keep the sourcetype as it is 🙂

[hettervik]

I'm also interested in the project! If you still have it, please share. 🙂

[rpquinlan]

Hello Mikael,

I tried to look for your project on github, but didn't find it. Has it been abandoned, or just moved? This would be quite helpful for us. Thanks!

[aakwah]

I think you need to set tcp stanza instead of tcpsplunk in inputs.conf as per the following

[tcp://syslog.corp.company.net:162]
sourcetype = syslog

Please refer to doc:
http://docs.splunk.com/Documentation/Splunk/6.2.1/admin/inputsconf

[issdevt]

thank you!