First thing I would check is to make sure you only have the Cisco Security Suite and Splunk for Cisco Firewalls installed. If you have tried other apps like the TA for Cisco ASA, Cisco ASA and FWSM Field Extractions etc., I would suggest deleting them from the apps directory. They can cause issues with field extractions and searches.
1) Sourcetype should be automatically forced to “cisco_asa”, if not see step 3 for possible resolution.
a. To verify just run the below search, and verify that cisco_asa is correctly set as the sourcetype:
i. %ASA | dedup sourcetype | table sourcetype
b. Sometimes you might have to change the sourcetype for the UDP data to “syslog” for the Cisco Security App to recognize it.
2) Go through the setup page per App and save them. Restart Splunk.
3) If the additional sourcetype (cisco_asa) is not being created then the force transform REGEX is not working correctly. Here are the steps to fix this:
a. Edit the transforms.conf file in the Splunk_CiscoFirewalls App. ($SPLUNK_HOME/etc/apps/Splunk_CiscoFirewalls/default/transforms.conf)
[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
##REGEX = %ASA-\d+-\d+
REGEX = %ASA--\d+-\d+
FORMAT = sourcetype::cisco_asa
The default REGEX is incorrect (ie has -- instead of -). Just comment out the incorrect REGEX and uncomment the correct REGEX:
[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d+-\d+
#REGEX = %ASA--\d+-\d+
FORMAT = sourcetype::cisco_asa
