Getting Data In

Splunk for Cisco ASA not show Data

edroche
New Member

Installed Splunk for ASA, install Google Maps, Sideview Utilities and TA-cisco_asa. I have confirmed that log from my ASA 5510 are being indexed. What should I be looking at? I am new to Splunk and would really like to get this working. Any thoughts or ideas are appreciated.

Thanks
Ed

Tags (3)
0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

in the interest of posting something on an old topic... here's how this works:

1) you feed the data into a splunk index (Splunk > Add Data > open a network listener where Cisco or syslog is sending stuff, or start looking at a directory where a syslog server is writing files)

2) at that point you can search the data using Splunk's search language, or try out a prebuilt app that expects this kind of data.

3) You can also try using an add-on that models the data to the Splunk Common Information Model app, which lets you use Search -> Pivot to easily build searches or see the data in apps built for CIM.

0 Karma

clucca3
New Member

I downvoted this post because does not address my specific question

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...