Splunk Enterprise

Splunk Forwarder and spoof

dharmendra1979
New Member

Hello Team/USers,

This is Dharmendra and working on Splunk forwarder, I am having a question on Splunk forwarder in which we are facing problem. We need to set Splunk which is installed on Windows VM 2008 as Splunk will take the Syslogs from different Cisco devices and will send it to Firemon and SIEM tool simultaneously where Splunk IP should spoof and only Cisco devices IP should display on Firemon and SIEM console.

Thanks for your time.

Regards,
Dharmendra

Tags (1)
0 Karma

vlapeintuit
Explorer

Dharmendra,

We have a similar configuration. We route some of our cisco data to multiple SEIM's based on the source of the traffic. Take a look here
http://docs.splunk.com/Documentation/Splunk/4.2.3/Deploy/Routeandfilterdatad

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!