In Security Suite under Firewall > Overview search shows no results, viewing the Inspect shows search eventtype="cisco_firewall" | bin _time span=5m | stats count by eventtype, src_ip, dest_ip, host,log_level_desc,event_desc, _time If I remove each transform filter one at a time I find that neither log_level_desc or event_desc will return results, as if they do not exist in the indexed data. If I remove them both then results are displayed. Where do I start looking? ... View more

Have Security Suite and Firewall addon installed, ASA sending syslog to UDP:514 with sourcetype blank. Default Transform for source type not working, source type is being set to udp:514 not cisco_firewall or cisco_asa Mar 16 17:35:33 10.0.10.1 :%ASA-session-4-106023: Deny udp src Have added /local/transforms.conf [force_sourcetype_for_cisco_asa] DEST_KEY = MetaData:Sourcetype REGEX = %ASA-\w+-\w+ FORMAT = sourcetype::cisco_asa Why are default transforms not working? ... View more

I have installed both Cisco Security Suite and Cisco Firewall Add-On, I have UDP port excepting syslogs from an ASA with a souretype of cisco_firewall. I can view realtime data in Security Suite but the Cisco Firewall shows no results when I select Overview or Real Ti9me Dashboard. The Overview inspect shows: This search has completed and found 362 matching events. However, the transforming commands in the highlighted portion of the following search: search eventtype="cisco_firewall" | bin _time span=5m | stats count by eventtype, src_ip, dest_ip, host,log_level_desc,event_desc, _time over the time range: 3/14/12 3:00:00.000 AM – 3/14/12 3:00:00.000 PM generated no results. However if I select a time from the drop down or change the search to search eventtype="ciscofirewall" | bin _time span=5m results are disaplayed? ... View more