Getting Data In

Not able to see the syslogs of ASA on Splunk Web

New Member

Hi All,

I've configured my ASA to send syslog to splunk server installed on centos. I took capture on ASA and I can see packets are leaving the ASA. I took capture on centOS on port 514 and packets are making to the centOS machine as well. For some reason I don't see them on splunk web.

I've created data input for UDP port 514 (all default), Source type (cisco:asa).

I'm really not sure what is the piece of info or config I'm missing here.

I would appreciate your quick help here.


0 Karma


Are you looking to get data from your firewall for security events? If this is the case, you will need to install the Splunk for Cisco Security App which will provide a dashboard that contains Security Event Statistics, as well as being able to look at a Firewall Overview or Event Search.

0 Karma


What are you using to capture the syslog packets on the linux box? syslogd, rsyslog, syslog-ng, or splunk?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...