When you install the Splunk add-on for Cisco ASA does it change the sourcetype for those logs going forward? Also, can it change the sourcetype for logs already indexed?
If I remember correctly, the props.conf file included with this app uses the "rename=" function. This is a search-time rename so if you have a sourcetype named "foo" and you created this stanza:
[foo]
rename = bar
From now on, you could search "sourcetype=bar" for ALL data indexed of the original sourcetype "foo" because it is a search-time transformation. The original sourcetype should be available in _sourcetype.
You can reference this doc: http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Propsconf
If I remember correctly, the props.conf file included with this app uses the "rename=" function. This is a search-time rename so if you have a sourcetype named "foo" and you created this stanza:
[foo]
rename = bar
From now on, you could search "sourcetype=bar" for ALL data indexed of the original sourcetype "foo" because it is a search-time transformation. The original sourcetype should be available in _sourcetype.
You can reference this doc: http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Propsconf
I don't find that rename clause in the app.
$ pwd
/home/jimd/splunkTAasa/Splunk_TA_cisco-asa/default
$ grep -i rename props.conf
$