Attempting to use a Heavy Forwarder to forward a subset of cisco:ASA events to Splunk indexers, while sending ALL events to external syslog Servers. The filter to the indexers works, but unable to get ALL events to forward to the syslog servers. Have tried many combinations and permutations in the involved .conf files, but current configs are shown below. The effect should be that only one ASA-6 log level message is sent to the indexers, while ALL log level 6 messages are sent to the syslog servers. Only the 725003 log level 6 message is being sent to the syslog servers.
REGEX = ASA-[1|2|3|4|5]
DEST_KEY = _TCP_ROUTING
FORMAT = test1,test2
Since we are filtering on ASA 6 data we want to list the transform statement that is for the broadest range so in the example we want to list ASA1 before ASA6. ASA 4 Can be listed at any point. This is because splunk is setting flags on the data and by doing the narrow first than the broad the broad is over writing the flag on the narrow. So all data flow to ASA1 instead of the intended target.