All Apps and Add-ons

Splunk_TA_cisco-esa src_ip parses incorrectly

TonyLeeVT
Builder

The src_ip field in the Cisco ESA TA is not parsing correctly. I usually only get the last two digits of an IP address.

Original parser in stanza:

[src_dest_fields_for_cisco_esa]
REGEX = (?:DCID|ICID)\s+\d+\s+interface\s+.*[\s\(]*(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).*\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

I think the issue is that a greedy match is used where a non-greedy match should be used:

.* = greedy
.*? = non-greedy

See the revision below with the non-greedy match: "interface\s+.*?[\s(]"

[src_dest_fields_for_cisco_esa]
REGEX = (?:DCID|ICID)\s+\d+\s+interface\s+.*?[\s\(]*(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}).*\s+(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})(?:\s+port\s+(\d+))?
FORMAT = src_ip::$1 dest_ip::$2 dest_port::$3

Check out the regex101 link below to verify the non-greedy match:
https://regex101.com/r/tV6fJ5/1

rpille_splunk
Splunk Employee
Splunk Employee

Yes, this was also reported here: https://answers.splunk.com/answers/365911/small-bugreport-about-version-121.html

I have just added a Known Issue to the documentation here: http://docs.splunk.com/Documentation/AddOns/released/CiscoESA/Releasenotes#Known_issues so that you can follow along as this gets fixed.

Thanks!

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...