All Apps and Add-ons

Splunk Add-on for Cisco WSA: not extracting fields


Not sure if anyone came across this. I just installed Splunk Add-on for Cisco WSA v 3.1.1.

Ironport WSA Log is indexed as sourcetype cisco:wsa:squid

However, in my search window I am not being able to see any of the fields that is suppose to be extracted by props.conf and transforms.conf of the TA. I am only seeing default fields such as host, source, sourcetype etc,

TA is installed in heavy forwarder, indexer and the search head.


This is what I did to fix the transform. The original did not take into account underscores in the status.
In field transform: kv_for_cisco_wsa_squid

ORG: 19 groups
([0-9.]) *[0-9] ([0-9.]) ([A-Z_])/([0-9]) ([0-9]) ([A-Z]) ([^ ]) "?([^ "])"? ([^/])/([^ ]) ([^ ]) ([^ ]+) <([^,]+),([^,]+),"([0-9]{0,2}|-|\w+)","([^"]+)",[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,"([^"]+)",[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,"([^"]+)",[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^>]+>\s*-\s*"?([^"]+)"?$

FIX: 19 groups
([0-9.]) *[0-9] ([0-9.]) ([A-Z_])/([0-9]) ([0-9]) ([A-Z]\S[A-Z]) ([^ ]) "?([^ "])"? ([^/])/([^ ]) ([^ ]) ([^ ]+) <([^,]+),([^,]+),"([0-9]{0,2}|-|\w+)","([^"]+)",[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,"([^"]+)",[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,"([^"]+)",[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^,]+,[^>]+>\s-\s*"?([0-9.]*).$

Also to get the specific data inbetween the < .... > I replaced: ,[^,]+ with ,([^,]+)

My fix - YMMV - 51 groups
([0-9.]) *[0-9] ([0-9.]) ([A-Z_])/([0-9]) ([0-9]) ([A-Z]\S[A-Z]) ([^ ]) "?([^ "])"? ([^/])/([^ ]) ([^ ]) ([^ ]+) <([^,]+),([^,]+),([^,]+),"([^"]+)",([^,]+),([^,]+),([^,]+),([^,]+),"([^"]+)",([^,]+),([^,]+),([^,]+),"([^"]+)",([^,]+),([^,]+),"([^"]+)","([^"]+)",([^,]+),([^,]+),([^,]+),([^,]+),"([^"]+)","([^"]+)","([^"]+)","([^"]+)","([^"]+)","([^"]+)",([^,]+),([^,]+),([^,]+),"([^"]+)","([^"]+)",([^,]+),"([^"]+)",([^,]+),([^,]+),"([^"]+)","([^"]+)">\s-\s*"?([0-9.]*).$

0 Karma


Lets give a try,

  1. Hope you are running the search in Verbose mode.
  2. set the fileds extarction to automatic in props.conf, kv_mode=auto

Hope it can help.

0 Karma


Tired that. It resulted one or two extracted fields and very strange other fields.

I logged a support call with Splunk and been advised its a bug. Reported as ADDON-2774. They provided me a new regex as a work around, but that did not work either.

I rolled back the apps to older version.

0 Karma


Hi, from witch app do you send your querry?

0 Karma


I tried both in search as well as TA for wsa apps (by making it visible). Both same result. It may potentially a bug in the apps.

0 Karma

Path Finder

Share the query you are using?

0 Karma


index=webproxy sourcetype=cisco:wsa:squid

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...