Deployment Architecture

How to configure logging from Network devices (firewall,switches,routers etc) into Splunk (distributed environment)?

manmah4u
Explorer

Hello,

I have been working on Splunk for some time and have seen its use for server/application monitoring. I have been assigned with a task to index logs from Network devices (Routers,firewalls,IPS etc). The challenge over here is I absolutely have no idea how to configure hardware devices in my splunk environment consisting of 5 indexers, 2 search heads, 1 deployment server. I do understand that there would be ways for forwarding logs from network devices (syslog capability) to push logs to Splunk, but I'm confused about configurations to be made in splunk (as in indexer, forwarder, search head). Any pointers as in documents, Google links would help.

fdi01
Motivator

see this two link it can help you:

1-) http://answers.splunk.com/answers/4309/

2-) http://answers.splunk.com/answers/50082/

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this link:
http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor

see this ex:

/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index  your_index_name  -sourcetype %app% 

Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

0 Karma

manmah4u
Explorer

Thanks for swift Response, but what I'm looking is inputs.conf configurations in splunk to monitor logs from network devices in particular

0 Karma

fdi01
Motivator

to Add Data in splunk or to inputs.conf configurations in splunk to monitor logs from network devices in particular, see this ex:
/opt/splunk/bin/splunk add monitor /path/to/app/logs/ -index your_index_name -sourcetype %app% Where /path/to/app/logs/ is the path to application logs on the host that you want to bring into Splunk, and %app% is the name you want to associate with that type of data This will create a file: inputs.conf in /opt/splunk/etc/apps/search/local/ --
here is some documentation on inputs.conf: http://docs.splunk.com/Documentation/Splunk/6.2.3/admin/Inputsconf

0 Karma

fdi01
Motivator

first see this link : http://docs.splunk.com/Documentation/Splunk/4.1.8/Admin/WhatSplunkCanMonitor
to inputs.conf configurations in splunk to monitor logs from network devices in particular

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...