You can watch and listen to the replay of this workshop at http://bit.ly/UCS_SPLUNK. Robert Novak, our Cisco Big Data CSE along with two excellent speakers from Spunk: Kevin Faulkner, Product Manager and Wissam Ali-Ahmad, the Splunk Technical Alliance Manager did a live demo.

1. Q&A
© 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 1 of 221
Operational Intelligence at Scale with Cisco UCS
and Splunk
November 17, 2015
Q. Do you have a Splunk app for Cisco UCS® technology?
A. Yes, there is a Splunk app for Cisco UCS. It is a technical add-on located here:
https://splunkbase.splunk.com/app/2731/.
Q. What do you use for hot/warm/cold storage? What's the configuration in terms of cores and RAM for
indexers?
A. Refer to our reference architecture for all the hardware details:
http://www.cisco.com/c/dam/en/us/products/collateral/servers-unified-computing/le-44701-sb-splunk.pdf.
And the comprehensive CVD:
http://www.cisco.com/c/dam/en/us/td/docs/unified_computing/ucs/UCS_CVDs/Cisco_UCS_Integrated_Infrastructur
e_for_Big_Data_with_Splunk.pdf.
The Cisco® specific configuration does change as our requirements change.
Q. When will the Splunk app for Sourcefire be available on Windows? I believe it only supports UNIX now.
A. Cisco maintains the FireSIGHT app for Splunk.
Q. When you deploy Splunk for security analytics vs, IT operational, is it the same product/installation? Do
we just turn up more integrations and data usage? Or do people generally deploy these seperately?
A. The platform and Splunk Enterprise are the same. You would likely use different data sources and different
Splunk apps and integrations, and often these use cases are deployed separately.
Q. What syslog server cluster do you recommend for logging network device data?
A. We don't necessarily recommend a specific syslog server. Servers such as syslog-ng or rsyslog or standard
syslog to a Splunk forwarder should be fine.
Q. Does Splunk have application-specific monitoring and plug-ins (for instance, Microsoft-specific app
performance data, libraries accessed, and so on)?
A. Yes, our SplunkBase has add-ons for many technologies such as Cisco and Microsoft (SCOM and so on). An
add-on can be used to bring events from those data sources for monitoring.

2. © 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public. Page 2 of 2
Q. Has anyone done this as a service (for example, fo IT ops or security), and is there is a suggested
architecture?
A. We've heard of use cases where customers have deployed Splunk internally as a service.
Q. Can Splunk be used successfully for monitoring Windows and UNIX servers in an enterprise
environment? In other words, is Splunk capable to replace server monitoring tools such as Zenoss,
Nimsoft, and so on?
A. You can definitely monitor Windows and UNIX/Linux OSes and enterprise apps with Splunk. Some customers
use it with products such as Zenoss/Nagios or alone.