I am running Splunk Enterprise for Windows 7.1.3 and am trying to index Cisco FTD logs. I understand that the eStreamer will not work on a Windows platform; but, I am receiving data into the Cisco FTD dashboard from a Cisco ASA device. I believe that if I ensure a universal forwarder is properly configured on on the FTD, and the correct TCP forwarder connection is established, I can get data from the forwarder into the app.
My questons are:
Are there any .conf files on the forwarder that require modification?
What Server Class should I use for the FTD and what ports should be configured? (I'm reasonably certain this should be 8089, but will listen to any and all other opinions.)
Is there any step I am missing?
The firewall team would love to have this work.
Thanks
Ron Jones
