Docs Here. http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/SyslogTCP Splunk Addon for Cisco IOS based devices: https://splunkbase.splunk.com/app/1467/#/documentation Considerations: 1. Best practice to send syslog to a centralized syslog server. Install a universal forwarder on the syslog server and tail syslog log files. 2. Create an Index to store the data and set Access Control / Retention 3. Any TA's or Splunk Apps you can use? https://splunkbase.com search for cisco. Hope this helps. ... View more