Getting Data In

Not able to see the syslogs of ASA on Splunk Web

dineshverma
New Member

Hi All,

I've configured my ASA to send syslog to splunk server installed on centos. I took capture on ASA and I can see packets are leaving the ASA. I took capture on centOS on port 514 and packets are making to the centOS machine as well. For some reason I don't see them on splunk web.

I've created data input for UDP port 514 (all default), Source type (cisco:asa).

I'm really not sure what is the piece of info or config I'm missing here.

I would appreciate your quick help here.

Regards,
Dv

0 Karma

molinarf
Communicator

Are you looking to get data from your firewall for security events? If this is the case, you will need to install the Splunk for Cisco Security App which will provide a dashboard that contains Security Event Statistics, as well as being able to look at a Firewall Overview or Event Search.

0 Karma

xavierashe
Contributor

What are you using to capture the syslog packets on the linux box? syslogd, rsyslog, syslog-ng, or splunk?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...