Getting Data In

ingesting Cisco logs from kiwi syslog server

Path Finder

I've my cisco devices sending the logs to kiwi syslog server and writing them to several files, (ise,switches,asa...). I need to monitor and ingest the data. Which servers do I setup the monitoring on? I've 1 search,deployment,indexer,HF each.

0 Karma

SplunkTrust
SplunkTrust

Hi,

On your Kiwi Syslog Server (which is writing Cisco logs to different files), install splunk universal forwarder and start monitoring those different file.

For different type of data parsing, you may need to install various Splunk apps/add-ons on Indexer OR Heavy Forwarder and Search Head.

0 Karma

Path Finder

thanks, but I'm trying to find out which one of my server will be more suitable or recommended to create the setup of the add data? I already have the UF on the syslog server and the cisco app and addon installed and my output.conf, but didn't find any doc about where to configure the add data setup.

0 Karma

SplunkTrust
SplunkTrust

Universal Forwarder will send data to Indexer and Search Head will search those data from Indexer

0 Karma