EDIT : New information at the end.
When I run a search over our ASA, all the fields defined by the splunk_ta_cisco-asa work except one. I have severity lookups and vendor classes, but I have no "action" defined even though it should be. This is important because a lot of graphs in the network side of the Cisco Security Suite require "action" to be defined in order to report.
I'm not an expert by any means, but I spent time last week trying to track down how it should be doing what it doesn't quite do, but I still can't figure out why it's not working.
In props.conf, the lookup for action is defined right next to several lookups that work fine (like the severity lookup).
LOOKUP-cisco-asa-action_lookup = cisco_action_lookup vendor_action OUTPUT action
In transforms.conf, again next to others that work fine, the cisco_action_lookup is defined.
[cisco_action_lookup]
filename = cisco_action_lookup.csv
So, one of the broken searches is this:
eventtype=cisco-firewall action="*" | timechart count by action
It is easy to modify it to be a working search and test that the lookup actually works by just manually specifying the lookup ahead of search action="":
`eventtype=cisco-firewall | lookup cisco_action_lookup vendor_action OUTPUT action | search action="" | timechart count by action`
The fixed search returns data with action fully populated, unlike the unfixed search.
UPDATE : I have found out more and though it still doesn't make sense to me, perhaps it will to someone.
If I aliased the output field at the end so:
LOOKUP-cisco_action_lookup = cisco_action_lookup vendor_action OUTPUT action AS aa_action
then aa_action shows up just fine.
When I again remove the alias, action disappears from the output.
UNLESS I run a wide enough search (a day's worth of data or more) then I can sometimes find ONE "action" set to "unknown". So when aliased to aa_action, it shows up on about 20-35% of the events depending on what time period you pick. When not aliased, I get approximately one "action" per million events and it's set to unknown. (And it is indeed an odd line).
Can "action" be being unset somehow? Early on I grepped through the etc folders making sure, but I could have missed something. How best to find such a thing, if this is what's happening?
... View more
