The Splunk for Cisco ASA TA (http://apps.splunk.com/app/1620/) app expects the data to come in over the wire, either on TCP or UDP, and uses transform rules in props.conf to alter the sourcetype. This means that your rule to change the destination index has to fire on the udp:514 (or tcp:514) sourcetype of the original ingest. To change the destination index, you'll have to add another transform, after the sourcetype change (see below) and key that from the origin sourcetype.
I do this traditionally by first setting my transform to detect the base sourcetype string like this:
TRANSFORMS-0_sourcetype = force_sourcetype_for_cisco_asa
Then, choosing the name of the RHS of my TRANSFORMS keyword to sort lexically after the sourcetype rule, I do something like this:
TRANSFORMS-1_index = my_transform_force_index_for_asa
transforms.conf:
[my_transform_force_index_for_asa]
SOURCE_KEY = MetaData:Sourcetype
REGEX = cisco:asa
DEST_KEY = _MetaData:Index
FORMAT = firewall
Takeaway: You get one pass, top to bottom, left to right, of the indexing rules for your initial sourcetype upon contact with Splunk. Having a rule to first set sourcetype from udp:514 -> cisco:asa does not fire index-time rules for the new sourcetype. Search-time parsing properties would in fact be used, however.
