SPLUNK is really handy when it comes to analyzing logs of your network devices all in one place. Let’s start with setting up SPLUNK on an UBUNTU 16.04 server.
We will be installing the free version (version 7.2.1) for this tutorial. It allows for 500MB of log indexing daily. If you want to compare it with other versions then here is the link. https://www.splunk.com/en_us/software/features-comparison-chart.html
Step 1: Install splunk.
Go to your preferred download directory and download the free software.
ubuntu@splunk:/tmp$ wget https://download.splunk.com/products/splunk/releases/7.2.1/linux/splunk-7.2.1-be11b2c46e23-linux-2.6-amd64.debAfter downloading install it.
ubuntu@splunk:/tmp$ sudo dpkg -i splunk-7.2.1-be11b2c46e23-linux-2.6-amd64.debDuring installation it will ask to create a username and password. Note it down as it will be used to login to the splunk GUI
Start the service.
sudo service splunk startNow access the login page and enter the username/password you created earlier. By default splunk uses port 8000 and http
http://<server-IP-ADDRESS>:8000
STEP 2: Configure SPLUNK for Cisco Logs
First you need to configure a DATA INPUT. You will find that in the settings tab.
Since we will only be receiving from a Cisco device so we choose LOCAL inputs. Let chose TCP(for reliability) and port 514
Select the source type: enter syslog in filter and select it.
For Host setting I prefer IP. Reason is that DNS names can be awfully long which makes searching for hosts using DNS names difficult.
Click on Review, verify the settings and click Submit. That’s it.
STEP 3: Configure your Cisco devices to send logs to the splunk server IP address.R
Router# logging host <server-IP-address> transport tcp port 514 audit sequence-num-sessionRouter#logging trap informationalNow you should start receiving logs in splunk. You can find your logs in Search & Reporting on your splunk home page.
You can also search hosts in the search bar by using the filter:
host=”192.168.1.10″
