I was getting some error messages about Splunk being unable to parse the timestamp. I tracked it down to %ASA-5-304001 because it contains multiple lines, and each line is treated as a separate line entry, and only the first line has the timestamp, therefore, no timestamp to parse. Example of the event: May 21 14:46:52 FWHOSTNAME : %ASA-5-304001: 192.168.20.59 Accessed URL 52.94.232.32:http://52.94.232.32/x/ae12848777b41970a5f2 HTTP/1.1 Host: s.amazon-adsystem.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36 Accept: image/webp,image/apng,image/,/*;q=0.8 Referer: http://gslbeacon.lijit.com/beacon Do I need to create a new transforms.conf entry so this specific event code is line merged? I'm using the Splunk Add-On for Cisco ASA in Splunk Cloud. ... View more

I'm using Best Practical "Request Tracker 4" as my ticketing system, and I'm trying to pull the data in to Splunk for dashboarding purposes. Currently I have it set up on DBConnect, but there is a horrible one-to-many database set up where the same field names are used in multiple sourcetypes, making the Splunk searches having to use a lot of join and append commands. The other issue is the lastupdated field vs the createddate field and getting accurate information. We've found a better way, but I need help on improving it. Currently we: 1. Delete the current index of data since the values of recent tickets have probably changed since the last import 2. Export the CSV 3. Import in to Splunk Is there a way I can have a Splunk UF monitor a directory, import the CSV into perhaps a summary index, overwriting the old data with each import? Does the UF allow importing into a lookup? NOTE: I'm using Splunk Cloud, and have Heavy Forwarders on premise. ... View more