Getting Data In

Are there additional considerations for onboarding Cisco ASA data into Splunk?

Svill321
Path Finder

I apologize in advance if this is an extremely basic question, but I need to be sure I do this correctly.

I'm researching how to onboard Cisco ASA data into Splunk for my internship. I'm reading through the documentation here on how to get the data into Splunk, but I'm curious. Are there any additional considerations I should take when getting ASA into Splunk, or is the process the same as with any other device?

Here is the document I'm reading:
http://docs.splunk.com/Documentation/Splunk/6.6.1/Data/WhatSplunkcanmonitor

If there is other documentation you think I should read, please let me know.

Thank you.

0 Karma
1 Solution

Richfez
SplunkTrust
SplunkTrust

Yes, it's probably all you need. But no, you might need (or at least want) just a bit more. Oh, don't you love these "Maybe, Maybe Not?" answers?

If you want to get ASA data into Splunk then you likely need go no further than the above mentioned docs. You might have to do a little searching for specific issues (if any come across), but those will likely be all you need.

If you are truly trying to understand the data, you'll want to refer to Cisco's documentation on their various event ids. This Cisco Syslog Message guide could be useful or maybe this PDF version of same. If those aren't right, use your favorite search engine and search for "Cisco syslog events".

You don't have to memorize them or anything. Many or even most events are pretty straightforward. But occasionally you may want to look up the difference between two events, both with nearly the same data (or what appears to be the same data in different format), to see exactly what difference there is between them - might be a good opportunity to not send one of them in and save license. Or sometimes there's just an extra piece in the data you don't know what it is, so looking it up can be good.

Happy Splunking!
-Rich

View solution in original post

Richfez
SplunkTrust
SplunkTrust

Yes, it's probably all you need. But no, you might need (or at least want) just a bit more. Oh, don't you love these "Maybe, Maybe Not?" answers?

If you want to get ASA data into Splunk then you likely need go no further than the above mentioned docs. You might have to do a little searching for specific issues (if any come across), but those will likely be all you need.

If you are truly trying to understand the data, you'll want to refer to Cisco's documentation on their various event ids. This Cisco Syslog Message guide could be useful or maybe this PDF version of same. If those aren't right, use your favorite search engine and search for "Cisco syslog events".

You don't have to memorize them or anything. Many or even most events are pretty straightforward. But occasionally you may want to look up the difference between two events, both with nearly the same data (or what appears to be the same data in different format), to see exactly what difference there is between them - might be a good opportunity to not send one of them in and save license. Or sometimes there's just an extra piece in the data you don't know what it is, so looking it up can be good.

Happy Splunking!
-Rich

Svill321
Path Finder

Thank you very much! Sorry for taking so long to accept this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...