Splunk Search

How can I extract IP in/out from Cisco 5505 syslog events?

andrewsmiley
Engager

I'm already extracting the byte size from the event using this:
\s+bytes\s+(?\d+)\s

Is there a way to do an inline Field Extraction to also determine the incoming and outgoing IP?

Here is a sample of an event:
2012-05-11 12:49:41 Local3.Info 192.168.100.1 May 11 2012 12:49:41: %ASA-6-302014: Teardown TCP connection 11221124 for outside:65.208.108.42/42756 to inside:192.168.100.123/443 duration 0:01:24 bytes 561803 TCP Reset-O

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Have you tried the Splunk for Cisco Firewalls app on splunkbase? It will have extractions, views etc already done for you? Even if you don't want the app if you install it and look in the default/props.conf you'll see regex for extracting data you are looking for.

http://splunk-base.splunk.com/apps/22303/splunk-for-cisco-firewalls

You can also use the interactive field extractor within splunk to generate the regex - http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample

At search time you can use the 'rex' command to create field values if that's what you meant by inline.

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...