Trying to configure TA-cisco_ios app.
I cannot get the syslog sourcetype to transform to cisco:ios sourcetype.
I have a lot of syslog data streaming to the syslog sourcetype
The regex below works fine in a search query
Files were deployed to the indexers.
props.conf
[syslog]
TRANSFORMS-force_sourcetype_for_cisco_ios = force_sourcetype_for_cisco_ios, force_sourcetype_for_cisco_ios-xr
...
Transforms.conf
[force_sourcetype_for_cisco_ios]
DEST_KEY = MetaData:Sourcetype
REGEX = (?<\reported_hostname>\S+)(\s(?
FORMAT = sourcetype::cisco:ios
[force_sourcetype_for_cisco_ios-xr]
DEST_KEY = MetaData:Sourcetype
REGEX = (?<\reported_hostname>\S+)\s(?<\event_id>\d+):\s(?<\node_id>(?:[A-Z]+)\/(?:\d+)\/(?:[A-Z0-9]+)\/(?:[A-Z0-9]+)):(?<\device_time>.+)\s:\s(?<\process_name>[A-Za-z0-9_]+)[(?
FORMAT = sourcetype::cisco:ios
...
Any pointers / advise would be great!!!
The regex above may have not copy/paste correctly
Hi,
could you paste on raw Cisco IOS event from your Splunk server? I'll check why it doesn't match the provided regex in the app. If you're receiving syslog on TCP that could be the cause. I'll try to get that supported if you can get me some samples of your logs.
Regards,
Mikael
To enter code that shows all characters, you can use the 010101 button, or bracket it in back quotes ```.