Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently stumbled across Splunk 4 (by way of an advert on this very site...) and found that it had an "App" that's designed to work with Cisco IronPort WebSecurity and E-Mail Appliances! That's really awesome, because good IronPort reporting is something our IT-dept. is looking for.

Anyways - I'm totally lost on how to configure this thing. I've googled like a mad-man to find a guide or such like - but I haven't found anything.

Has anyone here set up IP / Splunk? Any tips/pointers?

share|improve this question

1 Answer 1

If you are not familiar with Splunk the quickest way to get the app working for you is to export your WSA logs in the squid format and configure set your data inputs to sourcetype=cisco_wsa_squid. This should be all you need to get the app up and running.

share|improve this answer
    
"If you are not familiar with Splunk (I'm not) the quickest way to get the app working for you is to export your WSA logs (How do I do this?) in the squid format (How do I do this?) and configure set your data inputs to sourcetype=cisco_wsa_squid (How do I do this?). This should be all you need to get the app up and running. " –  user91071 Aug 9 '11 at 19:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.