Splunk Search

How can I extract IP in/out from Cisco 5505 syslog events?

andrewsmiley
Engager

I'm already extracting the byte size from the event using this:
\s+bytes\s+(?\d+)\s

Is there a way to do an inline Field Extraction to also determine the incoming and outgoing IP?

Here is a sample of an event:
2012-05-11 12:49:41 Local3.Info 192.168.100.1 May 11 2012 12:49:41: %ASA-6-302014: Teardown TCP connection 11221124 for outside:65.208.108.42/42756 to inside:192.168.100.123/443 duration 0:01:24 bytes 561803 TCP Reset-O

0 Karma

sdaniels
Splunk Employee
Splunk Employee

Have you tried the Splunk for Cisco Firewalls app on splunkbase? It will have extractions, views etc already done for you? Even if you don't want the app if you install it and look in the default/props.conf you'll see regex for extracting data you are looking for.

http://splunk-base.splunk.com/apps/22303/splunk-for-cisco-firewalls

You can also use the interactive field extractor within splunk to generate the regex - http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample

At search time you can use the 'rex' command to create field values if that's what you meant by inline.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...