Why are reports no longer working and how to segregate syslog data by IP address (firewall)?

[rb51]

hi all,

we are currently monitoring few firewalls and picking up the data from syslog (514).

I used to have this search running beautifully:

sourcetype="cisco:asa" action="blocked"| stats count as Count by src_ip | rename src_ip as "Source IP" | rename dest_ip as "Destination IP" | sort -Count

However, now everything seems to be coming from sourcetype syslog

My questions are:

1) Why has this (sourcetype="cisco:asa" ) stopped working?
2) How do I segregate the data coming from Syslog by IP address (firewall) and filter the events I want (e.g.: 106023)

Any comments are appreciated

[saurabhbanethia]

sourcetype="cisco:asa" action=Accessed | stats count as Count by src_ip |dedup src_ip |rename src_ip as "Source IP" | rename dest_ip as "Destination IP" | sort -Count

Try this query

[rb51]

the issue is that sourcetype="cisco:asa" was working fine until 19 Jan....Then my colleague run the following in the firewall:

User 'enable_15', running 'CLI' from IP <> executed 'logging host inside <> format emblem'

from then the sourcetype became "syslog"

[simon_lavigne]

Not sure about your first question but if you can't get your sourcetype working, could you use the host field to identify which firewall/ip is forwarding the events? And then filter out events as per http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad