We are indexing a lot of Cisco syslog messages. I notice that the host field is extracted correctly, but src/dst IP addresses, ports, etc are not. Do we have to install one of the cisco apps to have these fields extracted automatically?
Are there any issues getting the cisco event data indexed?
If the events are indexing ok, i would probably use the IFX field extractor(grey/white arrow near events) on a sample event and create a few search time fields to extract the fields you require.
Search time fields are always preferred over index time fields.
Hi Becky, It sounds like you are indexing Cisco Firewall events, is that correct? You could use the Cisco Firewall add-on on Splunkbase and that should get the extractions correct. My assumption here is you are using a syslog extract which is getting the hostname since the firewall messages are in a syslog format. Take a look here and let me know if this works for you:
I would recommend getting the extractions from the Cisco Apps on Splunkbase. You will need to make sure that your sourcetype that you set for the data matches a stanza in the props.conf file in the app. They're not set in stone but it's better than having to extract all of the fields yourself. What Cisco product/products are you using?
Are there any issues getting the cisco event data indexed?
If the events are indexing ok, i would probably use the IFX field extractor(grey/white arrow near events) on a sample event and create a few search time fields to extract the fields you require.
Search time fields are always preferred over index time fields.
