Getting Data In

What sourcetype should I set Cisco:asa switch data to and how to set two different sourcetypes for one UDP data input?

Communicator

I have Splunk configured with UDP 514 as data input, with sourcetype cisco:asa (firewall) in the main index.
However, i need to send switch data too, and is being classified as cisco:asa too.
So, I have two questions:

1) What sourcetype should be the switch data (Cisco) ? (Maybe, syslog?)
2) How can I divide two different sourcetype for the same data input?, when I set soucetype in the Data Input configuration, i wrote cisco:asa as Manual, but I can't set any other sourcetype.

I'll be very thankful for any help

1 Solution

SplunkTrust
SplunkTrust

Hi rubeniturrieta,

best thing to set/leave UDP syslog input as sourcetype=syslog because if you take a look at the Cisco iOS TA App, it will re-write the sourcetype for all Cisco iOS events that match. I assume the Cisco ASA App will work the same way (did not use this myself, yet)

hope this helps ...

cheers, Mus

View solution in original post

SplunkTrust
SplunkTrust

Hi rubeniturrieta,

best thing to set/leave UDP syslog input as sourcetype=syslog because if you take a look at the Cisco iOS TA App, it will re-write the sourcetype for all Cisco iOS events that match. I assume the Cisco ASA App will work the same way (did not use this myself, yet)

hope this helps ...

cheers, Mus

View solution in original post

Communicator

Thanks You very much, with your instruction, now I have the rigth sourcetypes, with only one data input, and the switch was with the rigth sourcetype and field extractions too with Cisco iOS TA App.