Thanks for reading. We use Syslog-NG for our Cisco devices to push syslog messages to. I've read the directions on installation and the help file states Cisco devices need to have Splunk as a syslog target. Can the app use input from syslog-ng instead? If so, how would this be configured?
Sure, just set up a monitor stanza to read the log files generated by syslog-ng.
I.e.
[monitor:///var/log/remote/cisco_ios/*/syslog]
host_segment = 5
sourcetype = cisco:ios
If the logs are not already identified as IOS events and placed in their own directory such as in the example, replace sourcetype = cisco:ios with sourcetype = syslog
The Add-on will then take care of changing the sourcetype
Sure, just set up a monitor stanza to read the log files generated by syslog-ng.
I.e.
[monitor:///var/log/remote/cisco_ios/*/syslog]
host_segment = 5
sourcetype = cisco:ios
If the logs are not already identified as IOS events and placed in their own directory such as in the example, replace sourcetype = cisco:ios with sourcetype = syslog
The Add-on will then take care of changing the sourcetype