Answering #3 about syslog: To be honest, you can ignore the *Syslog app. I will likely rip that out of a future version and replace it with: A link to our docs on how to configure a UDP input Specify the right sourcetype to use so that the transforms included in the UCS app function properly. The app today does not do a whole lot with the syslog data. All of the dashboards in fact, use data gathered from the python scripts (collect.py). There are a few saved searches which do look at syslog data. Syslog is going to have audit log data, and state changes, like whenever someone changes a setting, or if a fault occurs. However, the fault dashboards contain a richer set of data that could only come from the API. Here are the relevant Splunk configurations that apply to Syslog: props.conf: [source::udp:514] TRANSFORMS-ucs1 = cisco_ucs_rename_1,cisco_ucs_rename_2 transforms.conf: [cisco_ucs_rename_1] REGEX = %UCS FORMAT = sourcetype::ciscoucs:syslog DEST_KEY = MetaData:Sourcetype [cisco_ucs_rename_2] REGEX = %AUTHPRIV FORMAT = sourcetype::ciscoucs:syslog DEST_KEY = MetaData:Sourcetype Here's what is going on with the above: If data comes in with the sourcetype udp:514, send it through the transforms noted If a syslog event contains the string %AUTHPRIV or %UCS, then change the sourcetype of that event at index time to ciscoucs:syslog. The syslog events which do not match the above, come from the NX-OS, not the UCS manager. They may or may not be of value, but Cisco advised me that they aren't useful. You could send them to the nullqueue if you wanted. At search time, there is some field extraction performed on both of the above sourcetypes: [source::udp:514] EXTRACT-syslog fields = (?:[^ \n]* ){10}(?P<facility>[^\-]+)\-(?P<severity>[^\-]+)\-(?P<mnemonic>[^:]+) [ciscoucs:syslog] EXTRACT-syslog-user = user (?P<user>[^ ]+) (?:logged in from|from) (?P<client_ip>[^ ]+) [ciscoucs:syslog] EXTRACT-syslog-bracketed = [^\[\n]*\[(?P<object>[^\]]+)\]\[(?P<scope>[^\]]+)\]\[(?P<action>[^\]]+) In Splunk terms, the above is really a minor amount of work, and in many environments, people are collecting syslog already. What I want to do is separate out the collection of syslog from the app, as there are many ways to do this and best practices that are discussed elsewhere that have nothing to do with the UCS app. As long as you can get the data into Splunk with the udp:514 sourcetype, everything else will work. And if you don't like that sourcetype, you can change it in two files, and then the UCS app would comply with whatever you are already doing. HTH ... View more

This is currently being worked on. Be sure to hit the subscribe button on the app download page to be notified when it has been updated. ... View more

Actually, this is just a bit of a documentation problem. I will update the readme to reflect how to deploy a light forwarder in version 6. I'm also working with our docs team to have a bit more guidance in the Splunk Enterprise release notes. This is still a supported feature that exists within the product, but it's been deprecated. To deploy a light forwarder, follow the steps documented here: http://docs.splunk.com/Documentation/Splunk/6.0/Forwarding/Deployaforwarder ... View more