Getting Data In

Ingesting Logs from Cisco Routing and Switching Gear

603_Dan
New Member

Hi,

I've been asked to add inputs to my organization's Splunk Enterprise from Cisco Routing and Switching Gear. I remember reading in the documentation that Splunk's recommended best practice in is to use a syslog-collector running a UF or HF between the Routers/Switches and Indexers to keep the Indexers from becoming flooded with incoming traffic.

 

I had thought to do this with a Linux machine running a UF or HF and ingesting Router/Switch log traffic before forwarding the traffic along to Splunk Enterprise but I've been told an additional machine, even a virtual one, is a no go. I don't believe a Windows syslog-collector would work either as Windows can't do this with native tools, and I've been told 3rd party software is also a no-go.

 

Could anyone recommend a solution that doesn't use a Linux syslog-collector, a Windows syslog-collector running 3rd party software,  that meets Splunk's best practice suggestions?

 

Thank you,

603_Dan 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Sorry, but if someone wants to receive syslog events (most probably UDP ones) and isn't prepare to create additional component needed to process this trafic... well, then we can't do much.

Yes, splunk can listen on TCP or UDP port for incoming syslog events but it's not a solution advised for production use. Furthermore, I assume that your company is running an all-in-one installation. Processing all input data along with all the other splunk server activity is not a very good idea (again - especially if you're going to be dealing with UDP events which are prone to getting lost).

So in short - your company is trying to make you move a 5 ton steel beam giving you only a Mazda MX-5. Sorry, it won't fly however strongly you wish for it.

0 Karma

603_Dan
New Member

> So in short - your company is trying to make you move a 5 ton steel beam giving you only a Mazda MX-5. Sorry, it won't fly however strongly you wish for it.

Thank you for saying that. It doesn't help but it DOES make me feel better. 🙂

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...