Splunk for Cisco Firewalls and Flat-files

[sbusby]

I have all syslog from switches, routers, ASAs and FWSMs received via UDP/514 being written to a flat file and rotated daily. Today Splunk is indexing this data, but I was interested in seeing what the additional Cisco Security Apps could show me.

When I installed the applications it appears to want to listen in on a new UDP or TCP port, how can specify this application use the existing flat-file?

[kenth]

You could force the sourcetype "cisco_asa" on your flatfile index easily enough by either doing it in the apps props.conf or just set it when you add your file to be indexed. If you do that those logs should be included in what the app does.

[sbusby]

Since the flat file includes syslog from routers, switches, ASAs, FWSMs, etc wouldn't this classify ALL traffic as cisco_asa?