Getting Data In

How to configure a Heavy Forwarder to forward a subset of Cisco ASA events to Indexers, while sending ALL events to external syslog servers?


Running 6.5.0.

Attempting to use a Heavy Forwarder to forward a subset of cisco:ASA events to Splunk indexers, while sending ALL events to external syslog Servers. The filter to the indexers works, but unable to get ALL events to forward to the syslog servers. Have tried many combinations and permutations in the involved .conf files, but current configs are shown below. The effect should be that only one ASA-6 log level message is sent to the indexers, while ALL log level 6 messages are sent to the syslog servers. Only the 725003 log level 6 message is being sent to the syslog servers.


TRANSFORMS-asa = cisco_asa_elim_specific_msg_id, cisco_asa_indexers, cisco_asa_syslog_routing


REGEX = .*?(ASA-4-419002):.*
#  REGEX = .
  DEST_KEY = queue
   FORMAT = nullQueue
## Keep requied Log levels and message ids and send to splunk indexes
REGEX = ((ASA-2|ASA-3|ASA-4|ASA-1|ASA-5|ASA-6-725003))
   DEST_KEY = queue
   FORMAT = indexQueue
## route  all events  to other servers
   FORMAT = syslogServer1, syslogServer2 

Splunk Employee
Splunk Employee

When you do this you need to place the broadest transforms statement first in your props.


REGEX = ASA-6-725003
FORMAT = test1,test2

REGEX = ASA-[6]-*

REGEX = ASA-[1|2|3|4|5]
FORMAT = test1,test2

Since we are filtering on ASA 6 data we want to list the transform statement that is for the broadest range so in the example we want to list ASA1 before ASA6. ASA 4 Can be listed at any point. This is because splunk is setting flags on the data and by doing the narrow first than the broad the broad is over writing the flag on the narrow. So all data flow to ASA1 instead of the intended target.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...