in the interest of posting something on an old topic... here's how this works:
1) you feed the data into a splunk index (Splunk > Add Data > open a network listener where Cisco or syslog is sending stuff, or start looking at a directory where a syslog server is writing files)
2) at that point you can search the data using Splunk's search language, or try out a prebuilt app that expects this kind of data.
3) You can also try using an add-on that models the data to the Splunk Common Information Model app, which lets you use Search -> Pivot to easily build searches or see the data in apps built for CIM.
