how to collect log

[priyohw]

I install splunk in my windows server 2008, collecting log from windows working fine.
I need some help to collect log from solaris 10 and cisco device.
what should i do?

please help me.

[priyohw]

Thank you for this answer,
i will try it as your suggestion.

[MHibbin]

Ok if this does work, can you mark the answer as accepted, as this will help tell the community that your question does not need answering, and it also helps those looking for answers.

[MHibbin]

If the files you are looking for Splunk to collect are stored locally, you will probably need to install a Lightweight Forwarder (LF) or a Universal Forwarder (UF) on the device you wish to collect from (i.e. the Solaris 10 machines). You can find information on these here. And the UF download here, and for LF it is a normal Splunk install, but you will need to follow the guide here.

With the cisco devices you are probably best monitoring the network ports (e.g. syslog), you can use the following guide for setting up this, here.

Please note these guides are all part of the Distributed Deployment Manual, which is very useful. You will just need to make sure that for some parts you are using unique ports to avoid conflict with traffic.

Regards,

[saurabh_tek]

The given links are not working @MHibbin.
Could you please share correct links.

[kristian_kolb]

Hi,

For your Solaris box(es), I suggest you use forwarders that you install on the hosts. For Cisco devices (appliances?) syslog is probably the way to go. If you already have an existing syslog server to which you send the Cisco logs, you could install a forwarder there, otherwise you can set up Splunk to act as a syslog server, and configure the Cisco devices to send the logs directly to Splunk.

For more information, please see the documentation for "Getting Data In":

http://docs.splunk.com/Documentation/Splunk/4.2.3/Data/WhatSplunkcanmonitor

hope this helps,

kristian