Getting Data In

What sourcetype should I set Cisco:asa switch data to and how to set two different sourcetypes for one UDP data input?

rubeniturrieta
Communicator

I have Splunk configured with UDP 514 as data input, with sourcetype cisco:asa (firewall) in the main index.
However, i need to send switch data too, and is being classified as cisco:asa too.
So, I have two questions:

1) What sourcetype should be the switch data (Cisco) ? (Maybe, syslog?)
2) How can I divide two different sourcetype for the same data input?, when I set soucetype in the Data Input configuration, i wrote cisco:asa as Manual, but I can't set any other sourcetype.

I'll be very thankful for any help

1 Solution

MuS
Legend

Hi rubeniturrieta,

best thing to set/leave UDP syslog input as sourcetype=syslog because if you take a look at the Cisco iOS TA App, it will re-write the sourcetype for all Cisco iOS events that match. I assume the Cisco ASA App will work the same way (did not use this myself, yet)

hope this helps ...

cheers, Mus

View solution in original post

MuS
Legend

Hi rubeniturrieta,

best thing to set/leave UDP syslog input as sourcetype=syslog because if you take a look at the Cisco iOS TA App, it will re-write the sourcetype for all Cisco iOS events that match. I assume the Cisco ASA App will work the same way (did not use this myself, yet)

hope this helps ...

cheers, Mus

rubeniturrieta
Communicator

Thanks You very much, with your instruction, now I have the rigth sourcetypes, with only one data input, and the switch was with the rigth sourcetype and field extractions too with Cisco iOS TA App.

Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...