Splunk not getting syslogs.

[deca2499]

Hello all,

I am having a problem with my Splunk install that it has stopped accepting syslogs from my Cisco ASA. It was working until 2 days ago. I have the ASA sending the logs to the Splunk server. I am trying to get it back up and running so that I can try and get my ASA access lists worked on. The Splunk install is on a Windows 2016 server and I do not know much about Linux. I really do not want to blow it away and have to redo it all from scratch...  I know the server is getting the logs as I have Kiwi on the box as well and it shows the logs as they come in. The firewall is off on the Windows server as well. Can anyone help and point me in the right direction to find out what is going on and get it fixed?

Thanks!

[scelikok · Accepted solution]

Hi @deca2499,

If you are running Kiwi and Splunk together and both listening Cisco ASA UDP syslog data, only one of them can get it.  Is it possible you started Kiwi two days ago?

[deca2499]

DANGIT! !   I didnt even think to look at the kiwi service that is on the server..  It was running, so it was probably getting them before Splunk.. I have now disabled the service and Splunk is getting what I was expected to...   Sometimes, you just have to look at the simple things.

Thanks!