Splunk Search

I have some Cisco syslog messages and not all of the fields are being extracted.

rsimmons
Splunk Employee
Splunk Employee

We are indexing a lot of Cisco syslog messages. I notice that the host field is extracted correctly, but src/dst IP addresses, ports, etc are not. Do we have to install one of the cisco apps to have these fields extracted automatically?

Tags (2)
1 Solution

Chris_R_
Splunk Employee
Splunk Employee

Are there any issues getting the cisco event data indexed?
If the events are indexing ok, i would probably use the IFX field extractor(grey/white arrow near events) on a sample event and create a few search time fields to extract the fields you require. Search time fields are always preferred over index time fields.

Link to IFX field extraction
http://www.splunk.com/base/Documentation/4.0.10/User/InteractiveFieldExtractionExample

An example of the event data would be needed if you need more assistance.

View solution in original post

0 Karma

Will_Hayes
Splunk Employee
Splunk Employee

Hi Becky, It sounds like you are indexing Cisco Firewall events, is that correct? You could use the Cisco Firewall add-on on Splunkbase and that should get the extractions correct. My assumption here is you are using a syslog extract which is getting the hostname since the firewall messages are in a syslog format. Take a look here and let me know if this works for you:

http://www.splunkbase.com/apps/All/4.x/Add-On/app:Cisco+Firewalls+Add-On

dskillman
Splunk Employee
Splunk Employee

I would recommend getting the extractions from the Cisco Apps on Splunkbase. You will need to make sure that your sourcetype that you set for the data matches a stanza in the props.conf file in the app. They're not set in stone but it's better than having to extract all of the fields yourself. What Cisco product/products are you using?

DJ

Chris_R_
Splunk Employee
Splunk Employee

Are there any issues getting the cisco event data indexed?
If the events are indexing ok, i would probably use the IFX field extractor(grey/white arrow near events) on a sample event and create a few search time fields to extract the fields you require. Search time fields are always preferred over index time fields.

Link to IFX field extraction
http://www.splunk.com/base/Documentation/4.0.10/User/InteractiveFieldExtractionExample

An example of the event data would be needed if you need more assistance.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...