If you don't want to remove SA-cisco-asa, you may want to do a modification in 'SA-cisco-asa/default/transforms.conf' ;
1. create directory 'local' under 'SA-cisco-asa'
2. copy 'default/transforms.conf' to 'local/transforms.conf'
3. add following to 'local/transforms.conf';
[networkservice]
filename = service-names-port-numbers.csv
max_matches = 1
copy file 'Splunk_CiscoSecuritySuite/lookups/service-names-port-numbers.csv' to 'SA-cisco-asa/lookups/service-names-port-numbers.csv'
restart splunk
no errors so far...
... View more