Index data through syslog push.

[dfigurello]

Hello guys,

I have a doubt about this application "Splunk for Cisco IronPort Web Security Appliance".
I'd like to index access log was through syslog, is this possible using syslog push?

My customer hasn't ftp server, easy way is through syslog. Your Ironport is version 7.5 and Splunk is version 6.

any procedure? any idea?

Tks.

[jorgepinto1]

Hi,

This assumes you're receiving not only wsa trough syslog but also other log types, also it assumes the logs are being sent in squid format.

On the indexer create an %SPLUNK_HOME%/etc/system/local/inputs.conf with:

[udp://514]
disabled=false

either on the same dir or on the local dir for the addon create a props.conf with:

[source::udp:514]
TRANSFORMS-change_cisco_wsa = set_sourcetype_cisco_wsa, set_index_cisco_wsa

and a local/transforms.conf with:

[set_sourcetype_cisco_wsa]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(xxx.xxx.xxx.xxx|xxx.xxx.xxx.xxx)[\w\.\-]*\]?\s
FORMAT = sourcetype::cisco_wsa_squid
DEST_KEY = MetaData:Sourcetype

[set_index_cisco_wsa]
REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?)\.\w+\s+)*\[?(xxx.xxx.xxx.xxx|xxx.xxx.xxx.xxx)[\w\.\-]*\]?\s
DEST_KEY = _MetaData:Index
FORMAT = cisco

the xxx.xxx.xxx.xxx are IP addresses for the wsa interface sending the syslog.

The first transform sets the sourcetype, the second sets the index, in this case, cisco.

Hope this helps.

Cheers,

J.