Hello,
I've recently upgraded Splunk to 4.2.5 running on Windows 2008 R2. I'm trying to get both the Cisco Security Suite and Citrix Netscaler applications working together. I have created a UPD:514 - syslog input and can confirm that I am receiving data.
So, my question is I need to create a sourcetype called 'ns_log' to enable the Citrix Netscaler to work correcly. The problem I have is I can not define the props.conf/transforms.conf to keep the 'cisco_asa' sourcetype and the new sourcetype 'ns_log'
Thanks in advance
Hi BrentSilva
are you asking about props and transforms in general or do you need two regex to match each new sourcetype?
cheers,
MuS
if possible provide some good syslog data and I will try to help you 😉
Hi MuS,
I think I am asking about both. From what I can see, somehow I have a working props & transform configuration from when the Cisco Security suite was installed & now I need to modify this (I believe) or add an additional one to get an additional sourcetyoe working for the Citrix Netscaler app.
I hope that make sense,
Brent