All Apps and Add-ons

How does Technology Add-On for Cisco ASA identifies ASA ,PIX and FWSM logs?

harshal_chakran
Builder

Hi,
Can anybody please explain that how the Technology add-on for Cisco ASA identifies which log files are given to it. As it supports ASA, PIX and FWSM , Am eager to know how this add on differentiates between them.
How does it come know that I fed it ASA logs and it has to force cisco:asa sourcetype to this logs??

Also why do we require an add-on, can't the application do this stuff on its on?

Please Help...!!!

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

View solution in original post

jconger
Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

harshal_chakran
Builder

Thanks jconger...

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...