Getting Data In

retrieving log files from my router

arobinson
New Member

I'm a new user of splunk, (demo) I wanted to analyze data from my router. Do I have to modify any setting in my router in order to have the files forwarded to the splunk directory?

Thanks

Tags (2)
0 Karma

southeringtonp
Motivator

Everything depends on your router model. The normal way to collect log entries from a router is via syslog.

There are two things you'll need to do:

  1. Configure the router to send syslog data
  2. Configure Splunk to receive the data.

For Cisco routers, the command is:

logging 172.16.1.20

Of course, replace the IP address with that of your Splunk server. There are plenty of other syslog references out there. For Juniper, this may help. Many home-class routers have an option to export syslog as well, typically buried under an "Advanced" menu somewhere.

On the Splunk side, you can either configure a Splunk listener on port 514/udp, or you can configure your syslog server to write out to a file and index that. For the latter approach, here's how to configure using syslog-ng.

It's also possible to enable remote logging with other syslog daemons, though you may lose some flexibility. On Windows, look for Kiwi Syslog.

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...