Cisco IOS / TA-cisco_ios props and transforms issue

[rickwolff]

Trying to configure TA-cisco_ios app.

I cannot get the syslog sourcetype to transform to cisco:ios sourcetype.

I have a lot of syslog data streaming to the syslog sourcetype

The regex below works fine in a search query

Files were deployed to the indexers.

props.conf

[syslog]

TRANSFORMS-force_sourcetype_for_cisco_ios = force_sourcetype_for_cisco_ios, force_sourcetype_for_cisco_ios-xr

...

Transforms.conf

[force_sourcetype_for_cisco_ios]

DEST_KEY = MetaData:Sourcetype

REGEX = (?<\reported_hostname>\S+)(\s(?\d+)?:\s(?:.\S+:\s)?(?<\reliable_time>[.*])?(?.+)?)?:\s%(?(?!POLICY_ENGINE|UCSM|FWSM|ASA|PIX|ACE)[A-Z0-9_]+)-(?<\subfacility>[A-Z12_](-?[A-Z_]))-?(?<\severity_id>[0-7])-(?<\mnemonic>[A-Z0-9_]+):\s(?<\message_text>.+)

FORMAT = sourcetype::cisco:ios

[force_sourcetype_for_cisco_ios-xr]

DEST_KEY = MetaData:Sourcetype

REGEX = (?<\reported_hostname>\S+)\s(?<\event_id>\d+):\s(?<\node_id>(?:[A-Z]+)\/(?:\d+)\/(?:[A-Z0-9]+)\/(?:[A-Z0-9]+)):(?<\device_time>.+)\s:\s(?<\process_name>[A-Za-z0-9_]+)[(?\d+)]:\s%(?<\category>[A-Z0-9_]+)-(?<\facility>[A-Z0-9_]+)-(?<\subfacility>[A-Z12_](-?[A-Z_]))-?(?<\severity_id>[0-7])-(?<\mnemonic>[A-Z0-9_]+)\s:\s(?<\message_text>.+)

FORMAT = sourcetype::cisco:ios

...

Any pointers / advise would be great!!!

The regex above may have not copy/paste correctly

[mikaelbje]

Hi,

could you paste on raw Cisco IOS event from your Splunk server? I'll check why it doesn't match the provided regex in the app. If you're receiving syslog on TCP that could be the cause. I'll try to get that supported if you can get me some samples of your logs.

Regards,

Mikael

[lukejadamec]

To enter code that shows all characters, you can use the 010101 button, or bracket it in back quotes ```.