Getting Data In

ingesting Cisco logs from kiwi syslog server

afolabia
Path Finder

I've my cisco devices sending the logs to kiwi syslog server and writing them to several files, (ise,switches,asa...). I need to monitor and ingest the data. Which servers do I setup the monitoring on? I've 1 search,deployment,indexer,HF each.

0 Karma

harsmarvania57
Ultra Champion

Hi,

On your Kiwi Syslog Server (which is writing Cisco logs to different files), install splunk universal forwarder and start monitoring those different file.

For different type of data parsing, you may need to install various Splunk apps/add-ons on Indexer OR Heavy Forwarder and Search Head.

0 Karma

afolabia
Path Finder

thanks, but I'm trying to find out which one of my server will be more suitable or recommended to create the setup of the add data? I already have the UF on the syslog server and the cisco app and addon installed and my output.conf, but didn't find any doc about where to configure the add data setup.

0 Karma

harsmarvania57
Ultra Champion

Universal Forwarder will send data to Indexer and Search Head will search those data from Indexer

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...