Getting Data In

TA-meraki Not Logging all Events to Splunk

Explorer

I've successfully installed and configured the TA-meraki app and have all the CIM compliant data coming into Splunk, my question is...why am I not getting all the logs in Splunk that appear in the Meraki Dashboard?

I'm currently receiving events for the following apps/roles in Splunk (below on the right), but when comparing it to the Roles configured on the Meraki-side (to the left), we're not receiving anything from the Security Events Role in Splunk, although it's logging fine into the Meraki dashboard. Any help would be GREATLY appreciated!

meraki-roles.pngScreen Shot 2020-11-16 at 1.40.17 PM.png

 

Labels (1)
0 Karma
1 Solution

Explorer

Meraki responded to us stating that not all Meraki logs are designed to be ingested by syslog when you configure the syslog option. So basically, it's expected to see logs in the Meraki dashboard you're not finding in Splunk.

Sorry, I'm sure it's not the answer you were looking for. Hopefully Meraki updates this moving forward!

View solution in original post

0 Karma

New Member

hello did you get to the bottom of this ? we have the same issue 

Thanks 

Dave

0 Karma

Explorer

Meraki responded to us stating that not all Meraki logs are designed to be ingested by syslog when you configure the syslog option. So basically, it's expected to see logs in the Meraki dashboard you're not finding in Splunk.

Sorry, I'm sure it's not the answer you were looking for. Hopefully Meraki updates this moving forward!

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!