topic Re: If I have multiple Cisco devices sending syslog directly to Splunk with the same source and sourcetype, how do I view them separately? in Getting Data In

If I have multiple Cisco devices sending syslog directly to Splunk with the same source and sourcetype, how do I view them separately?

mi5cyberninja — Thu, 19 Mar 2015 11:41:32 GMT

Although we have multiple threads related to this topic, none are useful and confusing for newbies like me.

I have multiple Cisco devices (Routers, ASA firewall, ACS server) and all are sending syslog info directly to Splunk.

I'd really feel grateful if anybody can give step by step recommendation on how to view them separately?.

I am confused especially when the sourcetype and source are showing cisco:asa for all the devices that is being searched (say for example, i m looking logs for SMTP relay and it is showing sourcetype as ASA)

Please help me friends!

Re: If I have multiple Cisco devices sending syslog directly to Splunk with the same source and sourcetype, how do I view them separately?

tachifelix — Mon, 28 Sep 2020 19:11:23 GMT

in search and repporting app
build 3 search:
1 with source=first source file who is in your index and save it like eventype Routers

    index=my_index source=first_source_name

2 index=my_index source=second_source_name save it like eventype asa_firewall
3index=my_index source=third_source_name save it like eventype acs_server

Re: If I have multiple Cisco devices sending syslog directly to Splunk with the same source and sourcetype, how do I view them separately?

esix_splunk — Thu, 19 Mar 2015 13:44:09 GMT

This is most likely because all of your devices are sending to the UDP input on the Splunk server, and you have that UDP input configured as cisco:asa. There are a few options to change this:

1) Create different UDP inputs for each device type:
UDP/514 = cisco:asa
UDP/515 = cisco:ios
UDP/515 = cisco:acs
UDP/516 = myunixsyslogfeeds

2) Alternatively, you can configure props and transforms to assign the sourcetype based on a match against the host content.

See this article for more information : http://docs.splunk.com/Documentation/Splunk/6.2.2/Data/Advancedsourcetypeoverrides

If you do either of the above, then at search time you can specifcy sourcetype=cisco:asa or sourcetype=cisco:acs etc.

Re: If I have multiple Cisco devices sending syslog directly to Splunk with the same source and sourcetype, how do I view them separately?

mi5cyberninja — Mon, 28 Sep 2020 19:11:26 GMT

@esix_splunk : OK, 1st option is good but still I would like to choose second option:

The document says:

Create a stanza in transforms.conf that follows this syntax:

[] - my value here is cisco_acs & SMTP
REGEX = -
FORMAT = sourcetype:: -
DEST_KEY = MetaData:Sourcetype

Could you please decode the above stanza for cisco acs and SMTP relay logs?

Re: If I have multiple Cisco devices sending syslog directly to Splunk with the same source and sourcetype, how do I view them separately?

Sloefke — Thu, 19 Mar 2015 15:54:22 GMT

Or even better, install the technology addons for Cisco ASA and ACS, most of it works just fine out of the box 🙂
If you're using a distributed environment, install them on your forwarders.

https://apps.splunk.com/app/1620/
https://apps.splunk.com/app/1811/

Re: If I have multiple Cisco devices sending syslog directly to Splunk with the same source and sourcetype, how do I vie

esix_splunk — Mon, 28 Sep 2020 21:08:42 GMT

You'd be better to start a new thread and ask the community for help in that manner.

Also, look at the Cisco IOS and ASA TA's that have all the extractions in place. You most likely can find the solution there.