Cisco Firewall Add-on

[ahammond]

Have Security Suite and Firewall addon installed, ASA sending syslog to UDP:514 with sourcetype blank. Default Transform for source type not working, source type is being set to udp:514 not cisco_firewall or cisco_asa

Mar 16 17:35:33 10.0.10.1 :%ASA-session-4-106023: Deny udp src

Have added /local/transforms.conf

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\w+-\w+
FORMAT = sourcetype::cisco_asa

Why are default transforms not working?

[tmeader]

Hmm, not sure what to tell you. That overloaded REGEX for force_sourcetype_for_cisco_asa will DEFINITELY match the new format. You aren't using a distributed environment at all are you? Separate indexer and search head? If by chance you are, these changes will need to be made on the indexer, since that where the sourcetype metadata is written. Also, just to be clear, you added that under the [ciscoapp]/local directory right? Not under /etc/system/local?

[ahammond]

Yes, that is correct, with the slashes and I did restart Splunk.

[tmeader]

You did restart Splunk after that change? Also, I'm assuming this is just due to the formatting on answers.splunk.com, but, you did put "%ASA-\w+-\w+" correct? Not without the slashes?

[cvajs]

the REGEX above is incorrect, you used "w" instead of regex char class "\w"
change your regex to be %ASA-\w+-\w+-
(or maybe the slash just didnt show up in your post because this forum code takes a single slash as a special char??)

you could "normalize" the event info by using a SEDCMD in default props for this source definition and replace ":%ASA-session" with "%ASA". see if this helps the app find the data you need, etc.

EDIT - i believe there are other posts about this issue.
see this post, should fix the problem
http://splunk-base.splunk.com//answers/42936/cisco-asa-logging-format-change