Hi All, The Splunk for Cisco Firewalls app doesn't seem to extract fields from all different Cisco FWSM syslog types (e.g. %FWSM-4-106100). Searching the knowledge base I found the Cisco ASA/FWSM Field extractions app made by user dps. I can see the props.conf file has got the right extractions. I'm trying to get these extractions into the Splunk for Cisco Firewalls app as I don't want to rename my sourcetype again. Anyone an idea if this will work and what should be the right way to establish this? Thanks in advance! /daniel ... View more