Getting Data In

Cisco Firewall addon data source

Path Finder

Can the Cisco Firewall addon be restricted to only analyze data from a specific source or sourcetype?

I have reports from Nagios coming in which contain references that trigger the [cisco_pix] stanza in /opt/splunk/etc/apps/cisco_firewall_addon/default/transforms.conf. These are being incorrectly rewritten with the cisco_firewall sourcetype.

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

Hi, If you look in the default/props.conf directory you will see:

TRANSFORMS-asa=cisco_asa TRANSFORMS-pix=cisco_pix TRANSFORMS-ios=cisco_ios TRANSFORMS-fwsm=cisco_fwsm

Remove these lines, then set the data input for the actual Cisco Pix firewall to cisco_firewall. This will prevent other things from getting source-typed when it matches %PIX.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Hi, If you look in the default/props.conf directory you will see:

TRANSFORMS-asa=cisco_asa TRANSFORMS-pix=cisco_pix TRANSFORMS-ios=cisco_ios TRANSFORMS-fwsm=cisco_fwsm

Remove these lines, then set the data input for the actual Cisco Pix firewall to cisco_firewall. This will prevent other things from getting source-typed when it matches %PIX.

View solution in original post

0 Karma

Path Finder

Will, Thanks.
One other thing proved useful - I updated the
TRANSFORMS-extract = ciscofirewallhostoverride to TRANSFORMS = syslog-host. Hostname extraction was failing for some reason.

0 Karma