All Apps and Add-ons

Cisco ASA fields extraction

obatard
New Member

Hello,

I have to analyze a flat log file of a CISCO asa syslog.
I uploaded the file via the Data input option.

Splunk doesn't recognize the fields like SRC/DST IP and port while I installed the Cisco Firewall app. The cisco_asa source type is not available into the list of source type during the upload.

Do you have an idea ?

Thanks

0 Karma

obatard
New Member

I found the solution.

  • First, create a file inputs.conf if it doesn't exist in /opt/splunk/etc/apps/Splunk_CiscoFirewalls/local/[inputs.conf]

  • Set into the file
    [monitor:///path_to_the_directory_to_be_monitored]
    disabled = false
    sourcetype = cisco_asa
    index = main

  • In Splunk, go to settings, data inputs, Add data. Next, click on "A file or directory of files" and click "Next"
    Select "Skip preview", write the same full path than in the inputs.conf file. Let the source type on Automatic and the index on main.

  • Wait to the data to be indexed

    • Think to add fields (src/dst ip etc... in the left pan) in the search app

Regards,

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...