How to use splunk to monitor my own router for event analysis?

[csevilla]

Hello guys,

I am very new to splunk enterprise so please bear with me...

Just want some advice or getting started tips on how can i use splunk in my own router for its event analysis.

i already search from google... but i not quite sure about it.

regards

[stephane_cyrill]

There are splunk Apps that can help you do that:

https://splunkbase.splunk.com/app/1214/

https://m.youtube.com/watch?v=pgJ4dtIn5wo

[csevilla]

hi stephanie

thanks for the links..will take a look at it.

regards

[aholzel]

You can't install splunk on your router, unless you are using a Linux server as a router, in that case it is possible.
I assume you want your router logs to be send to a Splunk server. In that case the router need to support syslog to send out the logs to a syslog server.

The best way is to let your router send the logs to a server, let a syslog deamon (syslog-ng, rsyslog) catch the messages and write them to a file, and then let Splunk monitor that file. That way if you are fooling around in Splunk and need to restart Splunk you don't lose you logs for that time period. You can run the syslog deamon and Splunk on the same server (for home use...).

[csevilla]

hi aholzel,

thank you for the reply., so in that case i need to configure my router right?

[aholzel]

yes you need to configure your router to send out the logs to a syslog server.

[niteshbharadwaj]

can you please let me know as on how to configure the router for this process