All Apps and Add-ons

Splunk Add-on for Cisco ASA incorrect Extraction of user

bmacias84
Champion

In Splunk Add-on for Cisco ASA user is incorrectly be extracted. Instead of extracting extracting the username as the value, the value is "user". In the event below, the field user should be cassandra, but is returned as "user".

Example event:
Jun 8 14:44:35 lue-wai-wei-00s : %WEI-6-000001: PIA user authentication Successful : server = 062.11.01.83 : user = cassandra

The issue is most likely a transform issue.

Splunk Add-on for Cisco ASA, version 3.2.2, build 263053

1 Solution

bmacias84
Champion

I have found the bug in the transform named cisco_fw_kv_3.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$1 

The regex statement has to matching groups. $1 retrieves first matching group which contains user. The correct matching group is $2. This is a Splunk app bug in splunk_ta_cisco-asa. Fix is below.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$2 

View solution in original post

bmacias84
Champion

I have found the bug in the transform named cisco_fw_kv_3.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$1 

The regex statement has to matching groups. $1 retrieves first matching group which contains user. The correct matching group is $2. This is a Splunk app bug in splunk_ta_cisco-asa. Fix is below.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$2 

View solution in original post

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, this is a known issue that should go in the next maintenance release (ADDON-3916) -- we'll update the docs.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!