Noob question regarding sourcetypes

[mattelliott]

I have splunk running with the Cisco Firewall app installed. I'm still learning my way around but I'm slowly getting the hang of it. Along with getting data from multiple firewalls (all working as expected), I'm also collecting syslog data from about 300 routers and switches. Some of the entries show up as sourcetype "cisco", and some just show up as "syslog". Unless I'm mistaken, it's because this bit of config in the Splunk_CiscoFirewalls/default/transforms.conf:

[force_sourcetype_for_cisco_catchall]
DEST_KEY = MetaData:Sourcetype   
REGEX = :\s\%((SNMP|CDP|FAN|LINE|LINEPROTO|RTD|SYS|C\d+_[^-]+)-\d+-\S+)      
FORMAT = sourcetype::cisco

So anything with SNMP,CDP,FAN,etc. gets the sourcetype cisco, the rest just goes to syslog. I would like some guidance about either getting all non-ASA entries categorized as cisco. If that's not feasible, I don't mind categorizing them all as syslog, but I'd like to make sure I'm not going to break the firewall app if I comment out that section.

Also, in the process of trying to do this on my own, I accidentally created a bunch of bunk sourcetypes that I don't want to keep. They're along the lines of

"Sourcetype::cisco Severity::Jan Message_Type::%ASA-2-106006"    
"Sourcetype::cisco Severity::Jan Message_Type::%ASA-2-106001"

There are about 20 of them that got created when I screwed up the transforms.conf file. When I try to search on those events to delete them, I always get zero results. Did I screw myself over or is there way to clean those up?

Thanks,
Matt

[MarioM · Accepted solution]

regarding getting all non-ASA entries categorized as cisco if all your syslog is only cisco you could change the regex to match everything which is not ASA:

[force_sourcetype_for_cisco_catchall]
DEST_KEY = MetaData:Sourcetype   
REGEX = :\s\%(([^ASA]\d+_[^-]+)-\d+-\S+)      
FORMAT = sourcetype::cisco

Regarding the wrong sourcetype i am afraid you might have to do a ./splunk clean eventdata -index <index_name> in CLI

[mattelliott]

That almost did it. Thanks for your help. I ended up with

REGEX = :\s\%((?!ASA)\w+)-(\d)-\S+