How to set up and add CISCO L3 switches to Splunk ?

[grandeurxg]

Hi,

I'm very new to Splunk. My manager gave me a task how to add CISCO L3 switches to Splunk.
My manager said the switches are able to send logs to the syslog, but the syslog server does not save the logs.

Could somebody give me instructions to add CISCO L3 switches to the Splunk ?

Thank you for reading and please help.

[dcharboneau_spl]

Docs Here.
http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/SyslogTCP

Splunk Addon for Cisco IOS based devices:
https://splunkbase.splunk.com/app/1467/#/documentation

Considerations:
1. Best practice to send syslog to a centralized syslog server. Install a universal forwarder on the syslog server and tail syslog log files.
2. Create an Index to store the data and set Access Control / Retention
3. Any TA's or Splunk Apps you can use? https://splunkbase.com search for cisco.

Hope this helps.