Splunk Cloud Platform

Getting logs to cloud

Pedro1x
New Member

Hi,

A new user here on Splunk.

It's been 4 hours that I am going through Splunk multiple documents and I am going in circle here. Maybe someone can point me to the right direction to get me started.

We have a new splunk cloud account, I am trying to get my cisco asa and pfsense logs to splunk cloud.

I installed on windows server splunk forwarder, But I can't figure out how to get the logs to the forwarder and then to the splunk cloud.

I specified on the ASA in the syslog server the IP of splunk forwarder but it doesn't seem like the forwarder is taking it.

PS: I already installed the spl credential on the forwarder and restarted the service. (I believe that's all that is needed for the forwarder to send data to the cloud right?)

Thank you for any help I can get.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you need to install the Universal Forwarder app downloaded from your Splunk Cloud search head and restart the UF.  If you see the UF's internal logs in the Cloud (index=_internal host=<<UF name>>) then it's working and any other data sent to the UF should also make its way to the cloud.

Sending syslog directly to a Splunk instance is not recommended, but should work as a trial.  (The preferred way is to send syslog to a dedicated syslog server with a UF on it or use Splunk Connect for Syslog (SC4S).)  The forwarder needs to have an input defined so it knows to listen on the port to which syslog data is being sent.  The inputs.conf stanza will look something like this:

[tcp://:514]
index = syslog
sourcetype = cisco:asa
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...