All Apps and Add-ons

How does Technology Add-On for Cisco ASA identifies ASA ,PIX and FWSM logs?

harshal_chakran
Builder

Hi,
Can anybody please explain that how the Technology add-on for Cisco ASA identifies which log files are given to it. As it supports ASA, PIX and FWSM , Am eager to know how this add on differentiates between them.
How does it come know that I fed it ASA logs and it has to force cisco:asa sourcetype to this logs??

Also why do we require an add-on, can't the application do this stuff on its on?

Please Help...!!!

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

View solution in original post

jconger
Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

harshal_chakran
Builder

Thanks jconger...

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...