Cisco Networks Add-on for Splunk Enterprise: How can I Use a nonstandard sourcetype to parse Cisco IOS logs?

[cnoulin]

Hello,
I try to use the cisco ios ta to parsing my ios logs.
I have created non standard sourcetype for my logs as follow :

[udp://XXX.XX.XX:514]
source = My-switch-name
sourcetype = network:cisco_switch
disabled = false
index = Network

and

[udp://XXX.XXX.XXX.XXX:514]
source = My-wlc-ap
sourcetype = network:cisco_wlc
disabled = false
index = Network

in the app, i have changed my eventtypes.conf as follow

[cisco_ios]

search = sourcetype=cisco:ios

search = sourcetype=network:*

but the logs are not parsed.

I'm new to Splunk and I have maybe forgotten something ?

Thanks for you help and sorry for my English 😄

[cnoulin]

thank you fir your answer.
With your help i have now a working app.

i have changed in props.conf of the TA-cisco_ios following line :

[cisco:ios]

[(?::){0}network:cisco_*]
...
nothing in the transforms.conf

and in the cisco_ios i have created a local/eventtypes.conf with theses lines :
[cisco_ios]
search = (sourcetype=network:cisco_switch OR sourcetype=network:cisco_wlc OR sourcetype=network:cisco_coeur_reseau)

Thanks again

[micahkemp]

eventtypes don't parse your data., props and transforms do. If you are creating a custom sourcetype for field extraction purposes you need to create the extractions in props.conf and transforms.conf.