Issue with Automatic field extraction

[swathiadireddy]

Below are the two different formats of the same events. With the first format the system is automatically extracting the fields and with the second format it is not automatically extracting the fields like fields as first format. Second format of data is more helpful with LogID (which is highlighted in red) included in the message.

Any Idea how to fix the automatic field extraction instead of doing manual field extraction or using rex when required ? Does any configuration changes are required on Splunk ? On Cisco device its just a filter change.

1. 288 <158>1 2020-04-22T23:46:10-04:00 171.171.148.171 Cisco: - - - 2020-04-22 23:46:10 - ABC_Device - [101.172.173.75] System()[] - User Accounts modified. Removed username ZYXY from authentication server AD-CAG.

2. 288 <158>1 2020-08-11T18:46:37-04:00 171.171.148.171 Cisco: - - - id=firewall time="2020-08-11 18:46:37" pri=6 fw=101.172.173.75 vpn=ABC_Device user=System realm="" roles=""
type=mgmt msg="ADM222222: User Accounts modified. Removed username ZYXY from authentication server AD-CAG."

[richgalloway]

Please share the props.conf settings for that sourcetype.

[swathiadireddy]

There are no changes made in Splunk. Its the same. Only changes were made on Cisco devices.

[richgalloway]

Yes and now there have to be changes to Splunk, but only after we know what the current settings are.