What sourcetype should I set Cisco:asa switch data to and how to set two different sourcetypes for one UDP data input?

[rubeniturrieta]

I have Splunk configured with UDP 514 as data input, with sourcetype cisco:asa (firewall) in the main index.
However, i need to send switch data too, and is being classified as cisco:asa too.
So, I have two questions:

1) What sourcetype should be the switch data (Cisco) ? (Maybe, syslog?)
2) How can I divide two different sourcetype for the same data input?, when I set soucetype in the Data Input configuration, i wrote cisco:asa as Manual, but I can't set any other sourcetype.

I'll be very thankful for any help

[MuS · Accepted solution]

Hi rubeniturrieta,

best thing to set/leave UDP syslog input as sourcetype=syslog because if you take a look at the Cisco iOS TA App, it will re-write the sourcetype for all Cisco iOS events that match. I assume the Cisco ASA App will work the same way (did not use this myself, yet)

hope this helps ...

cheers, Mus

[rubeniturrieta]

Thanks You very much, with your instruction, now I have the rigth sourcetypes, with only one data input, and the switch was with the rigth sourcetype and field extractions too with Cisco iOS TA App.