Running Splunk 4.2.4 in a distributed setup (1 SH + 1 Indexer).
In the Splunk for Cisco Firewall TA is defined the following in the apps transforms.conf:
REGEX = (Built|[pP]ermitted)
FORMAT = action::allowed actual_action::$1
Running the following search
sourcetype=cisco_asa actual_action=Built works OK.
sourcetype=cisco_asa action=allowed returns no results.
The transform is running, permissions are global read/write (set by the app), and i can see the 'action' field in the field picker, with the value "allowed" in it, but when it's added to the search it returns no results?
Also clicking on the value in the field picker returns no results.
Anyone have any ideas to try? (i've run out...) 🙂
Thank you Ayn! That was most definitely the issue which is now resolved 🙂
I will also submit this as a bug in the Cisco Firewall TA app (amongst a few others).