Cisco equipement in Splunk

[inessa40408]

Hello Splunkers 😉

Have any of you worked with log files of Cisco equipment:

- AP 9130

- WiFi Controller 9840

I am interested in how to add more information to log files.

And also: perhaps someone can share a use case for creating dashboards for this equipment.

Thanks in advance for your answers.

[gcusello · Accepted solution]

Hi @inessa40408 ,

I cannot help you in Cisco network devices configuration, but in Spunk, you can use  Cisco network Add-On ( https://splunkbase.splunk.com/app/1467 ) to correctly parse the logs.

usually these logs are ingested configuring the Cisco network devices to send their logs to a Splunk receiver using syslog.

To receive syslog, you can use Splunk network inputs ( https://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Monitornetworkports ), if you have few logs,

otherwise you should configure an rsyslog receiver that writes logs in files read by Splunk ( https://docs.splunk.com/Documentation/SplunkCloud/9.3.2408/Data/Monitorfilesanddirectories ).

For the dashboards they depend on what you need to monitor, anyway the Splunk App for Cisco Network Devices could help you: https://splunkbase.splunk.com/app/1352

Ciao.

Giuseppe

[inessa40408]

Thank you very much for your help! 🙂 

[gcusello]

Hi @inessa40408 ,

good for you, see next time!

let me know if I can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉