Splunk and Cisco ASA No Event Data

[brianma]

Hello,

I have DL'd and installed the following:

Splunk App for Cisco ASA ver 1.0
Splunk for Cisco ASA Technology Add-on ver 1.1
Google Maps
Sideview Utils

1. My Splunk server is receiving SYSLOG from my ASA ( verified with TCP Dump )
2. I can use a * to search the logfiles
3. I have updated my input.conf = sourcetype=cisco:asa, index: main

I still am showing no data in the following:

1. Fiewall Dashboard Page
2. Overview Page
3. Summary Page

Any help much appreciated.

Thanks,
Brian

[jbrodsky_splunk]

You should not need to set any inputs.conf changes to get your Cisco ASA sourcetyped correctly. it should be set to syslog sourcetype by default, and then there's a transforms.conf that should force the sourcetype to cisco_asa by regexing a match against the incoming syslog data. Any syslog data with "%ASA-" in it should be automatically sourcetyped as cisco_asa (not cisco:asa like you have above, I believe.)

There are a few apps out there that have a typo in them for the transforms.conf that does this, however. The stanza below is the correct one that should be in your transforms.conf under your app's default directory (check the one for the TA....). Note the commented out INCORRECT regex. The uncommented one is the one you want.

[force_sourcetype_for_cisco_asa]
DEST_KEY = MetaData:Sourcetype
REGEX = %ASA-\d+-\d+
#REGEX = %ASA--\d+-\d+
FORMAT = sourcetype::cisco_asa

Then check that your data is being sourcetyped correctly:

index=* %ASA | dedup sourcetype | table sourcetype

and you should be good to go.

[rshorter]

Splunk Add-on for Cisco ASA

I do not see this information below to make the change

My Splunk server is receiving SYSLOG from my ASA ( verified with TCP Dump )
I can use a * to search the logfiles
I have updated my input.conf = sourcetype=cisco:asa, index: main