Setting up Splunk/IronPort WSA

Posted by Ciddan on Server Fault See other posts from Server Fault or by Ciddan
Published on 2009-11-04T17:53:02Z Indexed on 2010/05/05 9:08 UTC
Read the original article Hit count: 530

Filed under:

splunk

|

cisco

|

logging

|

reporting

|

log-files

Hello everyone!

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's really awesome, because good IronPort reporting is something our IT-dept. is looking for.

Anyways - I'm totally lost on how to configure this thing. I've googled like a mad-man to find a guide or such like - but I haven't found anything.

Has anyone here set up IP / Splunk? Any tips/pointers?

Regards, Mikael Selander

© Server Fault or respective owner

Related posts about splunk

Running a reverse proxy in front of Splunk 4.x

as seen on Server Fault - Search for 'Server Fault'
So, I have previously installed Splunk 3.x behind a reverse proxy and downloaded the latest version (4.0.6 at time of typing) expecting it to be as easy to use as before. Sadly this was not the case. There appears to be some elements which are not being translated correctly through the reverse proxy… >>> More
Alternatives to Splunk?

as seen on Server Fault - Search for 'Server Fault'
I'm pretty impressed with Splunk, especially version 4. Pretty graphs, alerting (Enterprise only), and fast, accurate, searching. It's a great product. However, the cost just way too high to consider for full production use for our company. All we really need is to be able to index different logs… >>> More
Setting up Splunk/IronPort WSA

as seen on Server Fault - Search for 'Server Fault'
Hello everyone! I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's really awesome, because good IronPort reporting is something our IT-dept. is looking… >>> More
Thoughts on Free Splunk

as seen on Server Fault - Search for 'Server Fault'
I am considering implementing Splunk at my company but am leery about the financial investment. I noticed there is a free version of Splunk that seem to be good enough. Can anyone tell me if you are using the free version at your company? Do you find the free version to be adequate, or just a springboard… >>> More
Nagios vs Splunk

as seen on Server Fault - Search for 'Server Fault'
I am looking to implement log tracking at my current company. After some research it seems Nagios and Splunk are the two best options. I was wondering if there is a consensus with which is better. I understand that Splunk can be quite pricey if the non-free version is used. That being said I can… >>> More

Related posts about cisco

Cisco Unifed Communication integration for Microsoft Lync crashes on Remote Desktop services 2008 R2!

as seen on Server Fault - Search for 'Server Fault'
Hi everybody i have deployed office communication server 2007 R2 and communicator 2007 R2 and i made integration with Cisco Unified Communication Manager 7.1 in my network, i also uses Remote Desktop Servers 2008 R2 for Thin Client Computers, now that i installed Cisco UC integration client for communicator… >>> More
Cisco Unified Communication integration for Microsoft Lync crashes on Remote Desktop services 2008 R2!

as seen on Server Fault - Search for 'Server Fault'
Hi everybody i have deployed office communication server 2007 R2 and communicator 2007 R2 and i made integration with Cisco Unified Communication Manager 7.1 in my network, i also use Remote Desktop Servers 2008 R2 for Thin Client Computers, now that i installed Cisco UC integration client for communicator… >>> More
Cisco Prime NCS not starting

as seen on Server Fault - Search for 'Server Fault'
I have received the Cisco Prime OVA file and which we placed onto an Oracle virtual environment. We turn the VM on and the CLI boots, When we try to start the NCS service we get errors. HOSTNAME/USER# ncs start Starting Network Control System... Exception in thread "main" java.lang.NullPointerException … >>> More
how to set port forwarding on a cisco 881 router (with cisco configuration professional)

as seen on Super User - Search for 'Super User'
I recently got a cisco 881 router for work and I have everything working except port forwarding I want to forward all incoming port 80 requests to 10.10.10.60 and all incoming port 53322 requests to 10.10.10.40 im using cisco configuration professional and im not sure where to find this option thanks… >>> More
Cisco: Site-to-site VPN with cisco 878 and ASA weirdness

as seen on Server Fault - Search for 'Server Fault'
I currently have 2 sites, both connected to each other through 2 firewalls / routers in a site-to-site VPN. Pinging from server to server (Using 2mb/2mb SDSL) through that VPN obviously works, however, at one site, we have another internet connection (7m/400k ADSL), and only the link between the two… >>> More