All Apps and Add-ons

A few questions about TA-Meraki setup using Heavy Forwarders

floza001
Engager

Hello Myron,

We would like to install the TA-meraki app for our meraki data but I need some clarification on a couple of things. We use heavy forwarders in our environment. Please let me know if you have any questions. Thanks for your time.

  1. On our Heavy Forwarder, we can add a different UDP port for this data. Meraki can also forward on this port. Do we need to install the app on the heavy forwarder?
    1. Do we need to also install the app in the cloud?
    2. Or should we only install in the cloud and add the port on the heavy forwarder and force the sourcetype for that port to be “meraki”?
0 Karma

myron_davis
Path Finder

Sorry for the long delay. Apparently my subscriptions to be notified of forum posts regarding this tag was not working.

1 On our Heavy Forwarder, we can add a different UDP port for this data. Meraki can also forward on this port. Do we need to install the app on the heavy forwarder?

Yes and no (optional). There is one piece that executes on index "TRANSFORMS-meraki_date_clipper". Basically all it does is clip out the unix timestamp in preference to the syslog timestamp. Completely unnecessary (unless you want to save a few bytes in your log).

2 Do we need to also install the app in the cloud?

Yes

3> Or should we only install in the cloud and add the port on the heavy forwarder and force the sourcetype for that port to be “meraki”?

You'll still need the sourcetype by Meraki, which would be done on your heavy forwarder... but you'll need this on your search head (i.e. the cloud)

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...