Cisco logs though Heavy Forwarder

[tmardan]

Hello!

I'm trying to collect logs from Cisco ASA devices through Heavy Forwarder, I'm sending all Cisco ASA logs to my HF instance and then send them to indexers.

I want to parse these logs and send to indexers only VPN-event logs. How can I filter them?

Can I filter them using event types from Cisco Add-on?

[isoutamo · Accepted solution]

Hi
Here is example how filter ASA logs https://community.splunk.com/t5/Getting-Data-In/Trying-to-filter-ASA-syslogs-before-indexing-to-avoi...
You must update it based on what you want exactly filter out.
And you must do those filtering on HF not Indexers.
r. Ismo