How does Technology Add-On for Cisco ASA identifies ASA ,PIX and FWSM logs?

[harshal_chakran]

Hi,
Can anybody please explain that how the Technology add-on for Cisco ASA identifies which log files are given to it. As it supports ASA, PIX and FWSM , Am eager to know how this add on differentiates between them.
How does it come know that I fed it ASA logs and it has to force cisco:asa sourcetype to this logs??

Also why do we require an add-on, can't the application do this stuff on its on?

Please Help...!!!

[jconger · Accepted solution]

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

[harshal_chakran]

Thanks jconger...