Skip to main content
Lantern Home
Splunk Lantern

Cisco IOS devices with highest log volume

  1. Last updated
  2. Save as PDF

As network devices operate and route traffic, critical status information is regularly emitted via syslog. Hosts producing large volumes of syslog data can indicate a highly used device. However, the volume of syslog messages can also rise dramatically because of a network issue or misconfiguration. You want to identify which hosts are producing the largest volumes of syslog data and review the syslog messages to ensure the device is operating as expected. 

Data required 

Cisco IOS

The Cisco IOS system message logging process uses the syslog protocol to send important messages to remote logging services, such as Splunk. The required add-on expects the data stream to be assigned the syslog sourcetype by the input configuration and will rename it to cisco:ios in the transformation configuration. For details on how the transformation is implemented, see the props.conf and transforms.conf in the add-on and the Splunk documentation. For more information on syslog and Splunk, see the (SYSLOG) Syslog Data Collection section of the Splunk Validated Architectures white paper.

Procedure

  1. Configure the Cisco Networks Add-on for Splunk Enterprise (this add-on can also be used in Cloud environments.)
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype=cisco:ios
| stats count sparkline(count,15m) AS trend BY host
| sort - count
| head 10
| table host trend count

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype=cisco:ios

Search only Cisco IOS data. (besure to specify the index containing this sourcetype) 

| stats count sparkline(count,15m) AS trend BY host

Create a trend line of syslog message counts over the last 15 minutes. 

| sort - count

Sort the results with the highest count first.

| head 10

Display the top 10 results.

| table host trend count

 Display the results in a table with columns in the order shown.

Next steps

The result of this search shows the host and count of events over the last 15 minutes and includes a sparkline showing the trend for count. 

Finally, you might also want to look at similar searches in our article Managing Cisco IOS devices.