All Apps and Add-ons

How does Technology Add-On for Cisco ASA identifies ASA ,PIX and FWSM logs?

harshal_chakran
Builder

Hi,
Can anybody please explain that how the Technology add-on for Cisco ASA identifies which log files are given to it. As it supports ASA, PIX and FWSM , Am eager to know how this add on differentiates between them.
How does it come know that I fed it ASA logs and it has to force cisco:asa sourcetype to this logs??

Also why do we require an add-on, can't the application do this stuff on its on?

Please Help...!!!

0 Karma
1 Solution

jconger
Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

View solution in original post

jconger
Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

harshal_chakran
Builder

Thanks jconger...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...