How to send syslog to sandbox?

[vashidu]

How can i send syslog from my cisco asa to the splunk sandbox?

[cgaspard_splunk · Accepted solution]

Currently Splunk Sandbox DOES support forwarding data via Universal Forwarders.

On the other hand, raw UDP SYSLOG forwarding directly to the Sandbox (without a Universal Forwarder) is not supported. This is done for good reasons. To forward SYSLOG data from a host, a Universal Forwarder can be installed and configured to monitor and push local SYSLOG to the Sandbox.

[fortiwhall]

It looks like Splunk Sandbox (which I believe is different than splunk storm or cloud) only supports uploading data via files. In the Splunk Sandbox instance I just spun up, the only "Add Data" option is to upload a file. I was also wanting to send some live SYSLOG from some of my devices up to the Sandbox, but it appears the only way to really do this is to log to your own server somewhere, take the log files, and then upload them to Sandbox.

Splunk sandbox is currently available off the front page of Splunk by clicking "Free Splunk" and then clicking the Free Online Sandbox link.
This is the direct link http://www.splunk.com/page/sign_up/cloudtrial?redirecturl=/getsplunk/cloudtrial&ac=test_modal_online...

[ChrisG]

This is correct. The online sandbox only supports file upload, not forwarding or monitoring.

[MuS]

Take a look at the Cisco Docs http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/...

After that you enable network inputs in Splunk http://docs.splunk.com/Documentation/Splunk/6.1.3/Data/Monitornetworkports

cheers, MuS

[MuS]

Login to splunkstorm.com, select your project, click the data tab, under network data click select, then click authorize your IP address - done

[vashidu]

My cloud splunk must be missing a part of that then. Cant find that anywhere.

[MuS]

but because you were so keen and provided a lot of information, I was able to find the correct link http://docs.splunk.com/Documentation/Storm/latest/User/AdddataoverTCPorUDP

this includes a lot irony 😉

[MuS]

well you did not mention Splunk cloud at all 😉

[vashidu]

the linked document doesnt cover splunk cloud.