How do I send Cisco Meraki FW logs?

[frizzoS3]

I am trying to send logs from Cisco Meraki FW to our Splunk instance. No universal forwarder is on the FW. Can I still have the logs sent to Splunk?...would it be on port 514 or 9997?
Thank you

[rphillips_splk · Accepted solution]

@frizzoS3 port 9997 is the default port Splunk receives cooked TCP data on (from another splunk instance , ie: forwarder). Splunk can also receive uncooked (not processed by another Splunk instance) data over TCP or UDP. So if your Meraki appliance is sending syslog data to the Splunk indexer via port 514, then on the Splunk receiver you would need to enable UDP 514 in inputs.conf

inputs.conf
[udp://<remote server>:<port>]

• Similar to the [tcp://] stanza, except that this stanza causes the Splunk
  instance to listen on a UDP port.

• Only one stanza per port number is currently supported.

• Configures the instance to listen on a specific port.

• If you specify <remote server> , the specified port only accepts data
  from that host.

• If <remote server> is empty - [udp://] - the port accepts data sent
  from any host.

• The use of <remote server> is not recommended. Use the 'acceptFrom'
  setting, which supersedes this setting.

• Generates events with source set to udp:portnumber, for example: udp:514

• If you do not specify a sourcetype, generates events with sourcetype set
  to udp:portnumber.

ie:
configure on indexer
$SPLUNK_HOME/etc/system/local/inputs.conf
[udp://514]
disabled = 0

[frizzoS3]

Hi
Thank you for the info.
Would I need to restart the indexer after updating the file?

[frizzoS3]

Thank you for the info...greatly appreciated.

[frizzoS3]

Good Morning

I am currently not seeing any Sys logs coming from the FW...should I enable the following command?

splunk enable listen -auth :

This is the config on the inputs.conf file....
[udp://514]
disable = 0

Thank you

Frank

Thank you.

[rphillips_splk]

yes the indexer would need a restart
$SPLUNK_HOME/bin
./splunk restart

[frizzoS3]

HI
Thank you for that.
Would I need to restart the indexer after updating the inputs file?