Getting Data In

Splunk for Network Device Monitoring

ncbshiva
Communicator

Hi
Can Splunk forwarders be installed on network switches to capture data? I have a CISCO network switch from which I need to extract data for monitoring purposes.

I was wondering if I can use Splunk forwarder instead of any network probes

Also is there an app for network devices monitoring espeically for CISCO devices?

Awaiting your response

Thanks,

Tags (3)
1 Solution

bshuler_splunk
Splunk Employee
Splunk Employee

Nope. Have your switch send syslog data to a syslog server. Then use a splunk forwarder on the syslog server to ingest data into splunk.

View solution in original post

halr9000
Motivator

This two-part blog post covers techniques for getting data from Cisco switches via SNMP into Splunk:

http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt1/

http://blogs.splunk.com/2013/11/06/adventures-with-snmp-and-cisco-nexus-pt2/

0 Karma

halr9000
Motivator

bshuler_splunk
Splunk Employee
Splunk Employee

Nope. Have your switch send syslog data to a syslog server. Then use a splunk forwarder on the syslog server to ingest data into splunk.

bshuler_splunk
Splunk Employee
Splunk Employee

syslog-ng is rock solid. Your load will determine your configuration.
Network device -> syslog-ng -> Splunk Forwarder -> Splunk Indexer
Cisco Security Suite http://apps.splunk.com/app/525/

0 Karma

ncbshiva
Communicator

Hi
Thanks for your response, can you let me know the expected reference hardware and s/w configurations required for the syslog server?So the setup needs to be:
Network devices << Network Probes << Syslog Server << Splunk forwarder << Splunk Indexer Pls confirm Is there any readymade app for reading and dashboarding reports for cisco devices data? Thanks,

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...