topic Cisco Config Regex in Splunk Search

Cisco Config Regex

DBattisto — Wed, 06 Mar 2019 15:29:52 GMT

Before I begin work on what is likely to be a multi-day excursion, I wanted to see if this has already been done.

I am importing Cisco switch and router startupconfigs into Splunk in hopes of setting up a dashboard that will help us track progress for some compliance items. Unfortunately, the config file is not formatted well, as it is coming from another application's database. It's a text file that is composed of the regular config with '\r\n' being used to show new lines.

My goal is to get this parsed so that it shows individual interfaces as it's own field.

Has anyone had any luck with this endeavor, or anything similar? I'd appreciate some guidance or feedback if you have.
Thanks!

Re: Cisco Config Regex

lakshman239 — Wed, 06 Mar 2019 16:52:01 GMT

Have you tried loading the file on to splunk via data Inputs? I am sure it will parse and if not, we can adjust the props.conf to line break your events.

Re: Cisco Config Regex

DBattisto — Wed, 06 Mar 2019 19:20:40 GMT

Are you suggesting loading the config file directly as an individual file? I'm getting thousands of them from a database, so manually adding isn't an option unfortunately.

Re: Cisco Config Regex

woodcock — Thu, 07 Mar 2019 03:29:20 GMT

It sounds like a job for DBConnect:
https://splunkbase.splunk.com/app/2686/

Re: Cisco Config Regex

lakshman239 — Thu, 07 Mar 2019 09:30:20 GMT

Its one off to test config and parsing and validate your config/events are seen properly. You can do this in dev and setup/tune props.conf to match your needs and then deploy them in prod.

Alternately, you can use dbconnect as suggested by @woodcook

Re: Cisco Config Regex

DBattisto — Thu, 07 Mar 2019 11:49:14 GMT

Thanks for the suggestionm but perhaps I should add some context. I'm importing the configurations from SolarWinds, which is retrieved by writing a custom 'SWQL' (the SolarWinds Query Language eyeroll) query.

The configuration is stored as one column, meaning that it's not parsed out. How would I use dbconnect to help with this? I use dbconnect to import data from a different database already so it'd be interesting to hear what else I could be doing with it.

Re: Cisco Config Regex

lakshman239 — Thu, 07 Mar 2019 13:07:38 GMT

I assume the database which you use isn't supported by Dbconnect yet.. you may want to check compatibility/support and take a call. https://docs.splunk.com/Documentation/DBX/3.1.4/DeployDBX/Installdatabasedrivers#Supported_databases