All Apps and Add-ons

Splunk Add-on for Cisco ASA incorrect Extraction of user

bmacias84
Champion

In Splunk Add-on for Cisco ASA user is incorrectly be extracted. Instead of extracting extracting the username as the value, the value is "user". In the event below, the field user should be cassandra, but is returned as "user".

Example event:
Jun 8 14:44:35 lue-wai-wei-00s : %WEI-6-000001: PIA user authentication Successful : server = 062.11.01.83 : user = cassandra

The issue is most likely a transform issue.

Splunk Add-on for Cisco ASA, version 3.2.2, build 263053

1 Solution

bmacias84
Champion

I have found the bug in the transform named cisco_fw_kv_3.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$1 

The regex statement has to matching groups. $1 retrieves first matching group which contains user. The correct matching group is $2. This is a Splunk app bug in splunk_ta_cisco-asa. Fix is below.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$2 

View solution in original post

bmacias84
Champion

I have found the bug in the transform named cisco_fw_kv_3.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$1 

The regex statement has to matching groups. $1 retrieves first matching group which contains user. The correct matching group is $2. This is a Splunk app bug in splunk_ta_cisco-asa. Fix is below.

[cisco_fw_kv_3] 
REGEX = ([uU]sername|[uU]ser)\s*=\s*([^,][^\s\)]+) 
FORMAT = user::$2 

jcoates_splunk
Splunk Employee
Splunk Employee

Hi, this is a known issue that should go in the next maintenance release (ADDON-3916) -- we'll update the docs.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...