Getting Data In

Ingesting Logs from Cisco Routing and Switching Gear

603_Dan
New Member

Hi,

I've been asked to add inputs to my organization's Splunk Enterprise from Cisco Routing and Switching Gear. I remember reading in the documentation that Splunk's recommended best practice in is to use a syslog-collector running a UF or HF between the Routers/Switches and Indexers to keep the Indexers from becoming flooded with incoming traffic.

 

I had thought to do this with a Linux machine running a UF or HF and ingesting Router/Switch log traffic before forwarding the traffic along to Splunk Enterprise but I've been told an additional machine, even a virtual one, is a no go. I don't believe a Windows syslog-collector would work either as Windows can't do this with native tools, and I've been told 3rd party software is also a no-go.

 

Could anyone recommend a solution that doesn't use a Linux syslog-collector, a Windows syslog-collector running 3rd party software,  that meets Splunk's best practice suggestions?

 

Thank you,

603_Dan 

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Sorry, but if someone wants to receive syslog events (most probably UDP ones) and isn't prepare to create additional component needed to process this trafic... well, then we can't do much.

Yes, splunk can listen on TCP or UDP port for incoming syslog events but it's not a solution advised for production use. Furthermore, I assume that your company is running an all-in-one installation. Processing all input data along with all the other splunk server activity is not a very good idea (again - especially if you're going to be dealing with UDP events which are prone to getting lost).

So in short - your company is trying to make you move a 5 ton steel beam giving you only a Mazda MX-5. Sorry, it won't fly however strongly you wish for it.

0 Karma

603_Dan
New Member

> So in short - your company is trying to make you move a 5 ton steel beam giving you only a Mazda MX-5. Sorry, it won't fly however strongly you wish for it.

Thank you for saying that. It doesn't help but it DOES make me feel better. 🙂

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...