Community:GettingDataFromCiscoSecurityAgentIntoSplunk
From Splunk Wiki
(Redirected from Deploy:GettingDataFromCiscoSecurityAgentIntoSplunk)
Getting data from the Cisco Security Agent (CSA) into Splunk
Configure CSA to export to flat file as described in the Cisco documentation:
http://www.cisco.com/en/US/docs/security/csa/csa50/user_guide/Chap10.html#wp963302
Then, install and configure a Splunk forwarder on the CSA MC server using the following instructions:
http://www.splunk.com/doc/latest/admin/ForwardingandReceiving