Getting Data In

Not able to see the syslogs of ASA on Splunk Web

dineshverma
New Member

Hi All,

I've configured my ASA to send syslog to splunk server installed on centos. I took capture on ASA and I can see packets are leaving the ASA. I took capture on centOS on port 514 and packets are making to the centOS machine as well. For some reason I don't see them on splunk web.

I've created data input for UDP port 514 (all default), Source type (cisco:asa).

I'm really not sure what is the piece of info or config I'm missing here.

I would appreciate your quick help here.

Regards,
Dv

0 Karma

molinarf
Communicator

Are you looking to get data from your firewall for security events? If this is the case, you will need to install the Splunk for Cisco Security App which will provide a dashboard that contains Security Event Statistics, as well as being able to look at a Firewall Overview or Event Search.

0 Karma

xavierashe
Contributor

What are you using to capture the syslog packets on the linux box? syslogd, rsyslog, syslog-ng, or splunk?

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...