Cisco ASA fields extraction

[obatard]

Hello,

I have to analyze a flat log file of a CISCO asa syslog.
I uploaded the file via the Data input option.

Splunk doesn't recognize the fields like SRC/DST IP and port while I installed the Cisco Firewall app. The cisco_asa source type is not available into the list of source type during the upload.

Do you have an idea ?

Thanks

[obatard]

I found the solution.

• First, create a file inputs.conf if it doesn't exist in /opt/splunk/etc/apps/Splunk_CiscoFirewalls/local/[inputs.conf]

• Set into the file
  [monitor:///path_to_the_directory_to_be_monitored]
  disabled = false
  sourcetype = cisco_asa
  index = main

• In Splunk, go to settings, data inputs, Add data. Next, click on "A file or directory of files" and click "Next"
  Select "Skip preview", write the same full path than in the inputs.conf file. Let the source type on Automatic and the index on main.

• Wait to the data to be indexed

  • Think to add fields (src/dst ip etc... in the left pan) in the search app

Regards,