Archive

How does Technology Add-On for Cisco ASA identifies ASA ,PIX and FWSM logs?

Hi,
Can anybody please explain that how the Technology add-on for Cisco ASA identifies which log files are given to it. As it supports ASA, PIX and FWSM , Am eager to know how this add on differentiates between them.
How does it come know that I fed it ASA logs and it has to force cisco:asa sourcetype to this logs??

Also why do we require an add-on, can't the application do this stuff on its on?

Please Help...!!!

0 Karma
1 Solution

Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

View solution in original post

Splunk Employee
Splunk Employee

transforms.conf uses REGEX to determine the sourcetype based on the contents of the data. Here are the relevant sections:

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d-\d{6}
FORMAT = sourcetype::cisco:asa

[force_sourcetype_for_cisco_fwsm]
DEST_KEY = MetaData:Sourcetype
REGEX = %FWSM-\d-\d{6}
FORMAT = sourcetype::cisco:fwsm

[force_sourcetype_for_cisco_pix]
DEST_KEY = MetaData:Sourcetype
REGEX = %PIX-\d-\d{6}
FORMAT = sourcetype::cisco:pix

To answer your second question, keep in mind that there are 2 parts to any Splunk app:

Part 1 = get the data into Splunk.
Part 2 = analyze the data.

The TA (Technology Add-On) is responsible for collecting the data, doing transforms, props, eventtypes, etc.

The SA (Supporting Add-On - a.k.a. the visual part of the app) is responsible for dashboards, reports, saved searches, etc.

The reason it is broken up is for scalability in distributed environments.

View solution in original post

Thanks jconger...

0 Karma