Splunk Search

I have some Cisco syslog messages and not all of the fields are being extracted.

rsimmons
Splunk Employee
Splunk Employee

We are indexing a lot of Cisco syslog messages. I notice that the host field is extracted correctly, but src/dst IP addresses, ports, etc are not. Do we have to install one of the cisco apps to have these fields extracted automatically?

Tags (2)
1 Solution

Chris_R_
Splunk Employee
Splunk Employee

Are there any issues getting the cisco event data indexed?
If the events are indexing ok, i would probably use the IFX field extractor(grey/white arrow near events) on a sample event and create a few search time fields to extract the fields you require. Search time fields are always preferred over index time fields.

Link to IFX field extraction
http://www.splunk.com/base/Documentation/4.0.10/User/InteractiveFieldExtractionExample

An example of the event data would be needed if you need more assistance.

View solution in original post

0 Karma

Will_Hayes
Splunk Employee
Splunk Employee

Hi Becky, It sounds like you are indexing Cisco Firewall events, is that correct? You could use the Cisco Firewall add-on on Splunkbase and that should get the extractions correct. My assumption here is you are using a syslog extract which is getting the hostname since the firewall messages are in a syslog format. Take a look here and let me know if this works for you:

http://www.splunkbase.com/apps/All/4.x/Add-On/app:Cisco+Firewalls+Add-On

dskillman
Splunk Employee
Splunk Employee

I would recommend getting the extractions from the Cisco Apps on Splunkbase. You will need to make sure that your sourcetype that you set for the data matches a stanza in the props.conf file in the app. They're not set in stone but it's better than having to extract all of the fields yourself. What Cisco product/products are you using?

DJ

Chris_R_
Splunk Employee
Splunk Employee

Are there any issues getting the cisco event data indexed?
If the events are indexing ok, i would probably use the IFX field extractor(grey/white arrow near events) on a sample event and create a few search time fields to extract the fields you require. Search time fields are always preferred over index time fields.

Link to IFX field extraction
http://www.splunk.com/base/Documentation/4.0.10/User/InteractiveFieldExtractionExample

An example of the event data would be needed if you need more assistance.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...