Help with syslog tranforms/props

[a212830]

Hi,

I've inherited a splunk environment where the syslog needs a fair amount of clean-up. The incoming syslog messages are all types - servers, appliances, routers, switches.... Where possible, I route them using syslog-ng, and then do standard splunk processing. For anything that isn't caught, we route it to an "unknown" index, and I was thinking of adding props/transforms for some of these, so that I don't need to keep adding individual entries in syslog-ng.

Is there a way to add a props/transforms to look for standard cisco ios entries and routing them? The regex is "%[A-Z_]+-[0-9]-[A-Z_]+:".

I'm not sure how to add that to a transforms and route it.

Thanks!

[sloshburch]

Cross reference to related question (I think): https://answers.splunk.com/answers/638013/help-with-setting-index-and-sourcetype-via-transfo.html

[s2_splunk]

Take a look at this answer and see if it gets you started.

You can find applicable documentation here.

[a212830]

Thanks. I understand the concept of transforms, just need help with the regex. Can that actual regex be placed in the transforms?

REGEX = %[A-Z_]+-[0-9]-[A-Z_]+:

What happens if it doesn't meet the regex extraction?

[s2_splunk]

Yes, the REGEX key is there for you to specify the RegEx you want to apply.
If the RegEx match fails, the original index configured for the sourcetype will take effect. If you don't have an index predefined, the default index will be used. Unless you changed it, that's the main index.

If you are asking about the correct RegEx to identify standard Cisco log events, I'm afraid I can't help you. Maybe you can find some gems in any of the available TAs for Cisco products.

[sloshburch]

Also, being aware of the lastChanceIndex could end up being strategic for your approach here. See it in http://docs.splunk.com/Documentation/Splunk/latest/Admin/Indexesconf. You may find it helps you capture events for which you've yet to define an index or transforms stanza.