Which addon to install to onboard Cisco Catalyst 8500-12x router logs into Splunk ?

[dm1]

I need to onboard Cisco Catalyst 8500 router logs into Splunk. When I was looking for addons, I found the below addons that seem relevant 

1. Cisco Catalyst Add-on for Splunk - This is preferred as its Cisco built and supported.
   https://splunkbase.splunk.com/app/7538
2. Then there is this addon Add-on for Cisco Network Data - https://splunkbase.splunk.com/app/1467, but it is unsupported.

The instructions in the Cisco built addon are not very clear on how to onboard the router logs. 

Can someone please help?

[gcusello]

Hi @dm1 ,

until today, I always used the second one in many hundreds of project without any issue.

the fact that it isn't unsupported it's a new for me, but probably it was an oversight of mine.

The first one is Cisco supported so you could use it.

About instuctions for ingestion, I'm not a network specialist, but Catalysts, as other network appliances, should send their logs by syslog, so you can directly receive syslogs using Splunk, in an Heavy Forwarder, or (better),creating an rsyslog input that writes syslogs in a file that it is read by Splunk.

Ciao.

Giuseppe