Getting data from the Cisco Security Agent (CSA) into Splunk

Configure CSA to export to flat file as described in the Cisco documentation:

http://www.cisco.com/en/US/docs/security/csa/csa50/user_guide/Chap10.html#wp963302

Then, install and configure a Splunk forwarder on the CSA MC server using the following instructions:

http://www.splunk.com/doc/latest/admin/ForwardingandReceiving