Splunk Search

setting asa in order to get data via upd 514

stimpfl
New Member

Can anybody tellme how should my asa be configured in order to receive data into splunk ? what I mean is... my splunk configuration seems to be ok nevertheless I see no indexed data, therefore i think there must be something wrong in my asa, i've told it to send syslogs to my splunk server, and since i see info by wikisyslog I assume the data is getting there but I cant get it into index.
Thanks a lot in advance !!

Tags (1)
0 Karma

dturner83
Path Finder

Hope it's not too late to chime in here. It's mostly in the ASA logging configuration.
Enable Logging, set a logging host, and set your list.
Example configuratino here:

logging enable

logging timestamp

logging host [interface] [forwarder address or indexer] - Example[logging host inside 10.0.0.5]

logging list cisco message 111009

logging list cisco message 111008

logging list cisco message 304009

logging trap cisco[cisco is the logging list name]

And that is pretty much it. Make sure you've got an input for udp514 traffic and you should be seeing data provided the Splunk side of things is in shape.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...