I have a Linux syslog server that collects syslog from all of my Cisco and other networking devices and forwards everything off to Splunk with the Universal Forwarder. I would like to use the Cisco IOS for Splunk app but I need to install the Cisco IOS Technology Add-On to convert the log messages to the Cisco type.
Would I be able to install the Cisco IOS TA App on the Universal Forwarder or does it need to be on a light/heaver forwarder?
Hi,
the Technology Add-On cannot be installed on a Universal Forwarder. In fact there is no point in installing it on a UF. A good approach would be the following:
sourcetype=cisco:ios
You can of course use a heavy forwarder but I don't see the point of doing that as you can save CPU cycles by simply using dedicated UDP ports for your different sourcetypes to classify them at an early stage. For devices that aren't able to log syslog to any other port than 514 then you need to set the sourcetype to syslog and use regex to transform to the correct sourcetype.