Getting Data In

retrieving log files from my router

arobinson
New Member

I'm a new user of splunk, (demo) I wanted to analyze data from my router. Do I have to modify any setting in my router in order to have the files forwarded to the splunk directory?

Thanks

Tags (2)
0 Karma

southeringtonp
Motivator

Everything depends on your router model. The normal way to collect log entries from a router is via syslog.

There are two things you'll need to do:

  1. Configure the router to send syslog data
  2. Configure Splunk to receive the data.

For Cisco routers, the command is:

logging 172.16.1.20

Of course, replace the IP address with that of your Splunk server. There are plenty of other syslog references out there. For Juniper, this may help. Many home-class routers have an option to export syslog as well, typically buried under an "Advanced" menu somewhere.

On the Splunk side, you can either configure a Splunk listener on port 514/udp, or you can configure your syslog server to write out to a file and index that. For the latter approach, here's how to configure using syslog-ng.

It's also possible to enable remote logging with other syslog daemons, though you may lose some flexibility. On Windows, look for Kiwi Syslog.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...