Monitoring Splunk

Cisco equipement in Splunk

inessa40408
Explorer

Hello Splunkers 😉

 

Have any of you worked with log files of Cisco equipment:

- AP 9130

- WiFi Controller 9840

 

I am interested in how to add more information to log files.

And also: perhaps someone can share a use case for creating dashboards for this equipment.

 

Thanks in advance for your answers.

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @inessa40408 ,

I cannot help you in Cisco network devices configuration, but in Spunk, you can use  Cisco network Add-On ( https://splunkbase.splunk.com/app/1467 ) to correctly parse the logs.

usually these logs are ingested configuring the Cisco network devices to send their logs to a Splunk receiver using syslog.

To receive syslog, you can use Splunk network inputs ( https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Monitornetworkports ), if you have few logs,

otherwise you should configure an rsyslog receiver that writes logs in files read by Splunk ( https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Data/Monitorfilesanddirectories ).

For the dashboards they depend on what you need to monitor, anyway the Splunk App for Cisco Network Devices could help you: https://splunkbase.splunk.com/app/1352

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @inessa40408 ,

I cannot help you in Cisco network devices configuration, but in Spunk, you can use  Cisco network Add-On ( https://splunkbase.splunk.com/app/1467 ) to correctly parse the logs.

usually these logs are ingested configuring the Cisco network devices to send their logs to a Splunk receiver using syslog.

To receive syslog, you can use Splunk network inputs ( https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Monitornetworkports ), if you have few logs,

otherwise you should configure an rsyslog receiver that writes logs in files read by Splunk ( https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Data/Monitorfilesanddirectories ).

For the dashboards they depend on what you need to monitor, anyway the Splunk App for Cisco Network Devices could help you: https://splunkbase.splunk.com/app/1352

Ciao.

Giuseppe

inessa40408
Explorer

Thank you very much for your help! 🙂 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @inessa40408 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...