For starters, are you sure the UDP events are making it into Splunk? I would probably start out with checking some of the following: What port# do you have Splunk set to listen on? If it's < 1024 Splunk needs to be running as root. Check output of (on linux) netstat -anup to make sure it is listening. You may have another process (rsyslog/syslog-ng/etc) already listening on the default UDP syslog port. Use tcpdump to make sure the UDP packets from the ASA are arriving at the Splunk server, on the port you expect them on. If Splunk is listening on the right port and the packets are arriving at the splunk host, is the local host's firewall blocking the udp events? Run a realtime search on "*" and see if you can see these events showing up, perhaps under an unexpected sourcetype If Splunk is definitely getting the events, then there may be other problems. But you need to make sure the data is getting there first. ... View more