How can I extract IP in/out from Cisco 5505 syslog events?

[andrewsmiley]

I'm already extracting the byte size from the event using this:
\s+bytes\s+(?\d+)\s

Is there a way to do an inline Field Extraction to also determine the incoming and outgoing IP?

Here is a sample of an event:
2012-05-11 12:49:41 Local3.Info 192.168.100.1 May 11 2012 12:49:41: %ASA-6-302014: Teardown TCP connection 11221124 for outside:65.208.108.42/42756 to inside:192.168.100.123/443 duration 0:01:24 bytes 561803 TCP Reset-O

[sdaniels]

Have you tried the Splunk for Cisco Firewalls app on splunkbase? It will have extractions, views etc already done for you? Even if you don't want the app if you install it and look in the default/props.conf you'll see regex for extracting data you are looking for.

http://splunk-base.splunk.com/apps/22303/splunk-for-cisco-firewalls

You can also use the interactive field extractor within splunk to generate the regex - http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample

At search time you can use the 'rex' command to create field values if that's what you meant by inline.