- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How to send syslog to sandbox?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Currently Splunk Sandbox DOES support forwarding data via Universal Forwarders.
On the other hand, raw UDP SYSLOG forwarding directly to the Sandbox (without a Universal Forwarder) is not supported. This is done for good reasons. To forward SYSLOG data from a host, a Universal Forwarder can be installed and configured to monitor and push local SYSLOG to the Sandbox.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Currently Splunk Sandbox DOES support forwarding data via Universal Forwarders.
On the other hand, raw UDP SYSLOG forwarding directly to the Sandbox (without a Universal Forwarder) is not supported. This is done for good reasons. To forward SYSLOG data from a host, a Universal Forwarder can be installed and configured to monitor and push local SYSLOG to the Sandbox.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like Splunk Sandbox (which I believe is different than splunk storm or cloud) only supports uploading data via files. In the Splunk Sandbox instance I just spun up, the only "Add Data" option is to upload a file. I was also wanting to send some live SYSLOG from some of my devices up to the Sandbox, but it appears the only way to really do this is to log to your own server somewhere, take the log files, and then upload them to Sandbox.
Splunk sandbox is currently available off the front page of Splunk by clicking "Free Splunk" and then clicking the Free Online Sandbox link.
This is the direct link http://www.splunk.com/page/sign_up/cloudtrial?redirecturl=/getsplunk/cloudtrial&ac=test_modal_online...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is correct. The online sandbox only supports file upload, not forwarding or monitoring.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Take a look at the Cisco Docs http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/...
After that you enable network inputs in Splunk http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Monitornetworkports
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Login to splunkstorm.com, select your project, click the data tab, under network data click select, then click authorize your IP address - done
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My cloud splunk must be missing a part of that then. Cant find that anywhere.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
but because you were so keen and provided a lot of information, I was able to find the correct link http://docs.splunk.com/Documentation/Storm/latest/User/AdddataoverTCPorUDP
this includes a lot irony 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
well you did not mention Splunk cloud at all 😉
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the linked document doesnt cover splunk cloud.
Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!
Logs to Metrics
Developer Spotlight with Paul Stout
