Getting Data In

how can I analyze logs and extract fields from network device

lllidan
New Member

Even though I collected some logs from network device, like Cisco switch and firewall. but how can I analyze them and extract fields?
Splunk only supply a source "Cisco:asa", but it can only identify less fields from network device logs. Shall I extract them manually or there's another plugins to solve this problem?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @lllidan,
see in apps.splunk.com if there's a Technical Add-on for your device that gives you all the needed extractions: probably this is what you're searching https://splunkbase.splunk.com/app/1620/ .
I'm sure that you'll find what you need, but otherwise, you can use a regex for this extraction.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...