All Apps and Add-ons

Cisco IOS / TA-cisco_ios props and transforms issue

rickwolff
New Member

Trying to configure TA-cisco_ios app.

I cannot get the syslog sourcetype to transform to cisco:ios sourcetype.

I have a lot of syslog data streaming to the syslog sourcetype

The regex below works fine in a search query

Files were deployed to the indexers.

props.conf

[syslog]

TRANSFORMS-force_sourcetype_for_cisco_ios = force_sourcetype_for_cisco_ios, force_sourcetype_for_cisco_ios-xr

...

Transforms.conf

[force_sourcetype_for_cisco_ios]

DEST_KEY = MetaData:Sourcetype

REGEX = (?<\reported_hostname>\S+)(\s(?\d+)?:\s(?:.\S+:\s)?(?<\reliable_time>[.*])?(?.+)?)?:\s%(?(?!POLICY_ENGINE|UCSM|FWSM|ASA|PIX|ACE)[A-Z0-9_]+)-(?<\subfacility>[A-Z12_](-?[A-Z_]))-?(?<\severity_id>[0-7])-(?<\mnemonic>[A-Z0-9_]+):\s(?<\message_text>.+)

FORMAT = sourcetype::cisco:ios

[force_sourcetype_for_cisco_ios-xr]

DEST_KEY = MetaData:Sourcetype

REGEX = (?<\reported_hostname>\S+)\s(?<\event_id>\d+):\s(?<\node_id>(?:[A-Z]+)\/(?:\d+)\/(?:[A-Z0-9]+)\/(?:[A-Z0-9]+)):(?<\device_time>.+)\s:\s(?<\process_name>[A-Za-z0-9_]+)[(?\d+)]:\s%(?<\category>[A-Z0-9_]+)-(?<\facility>[A-Z0-9_]+)-(?<\subfacility>[A-Z12_](-?[A-Z_]))-?(?<\severity_id>[0-7])-(?<\mnemonic>[A-Z0-9_]+)\s:\s(?<\message_text>.+)

FORMAT = sourcetype::cisco:ios

...

Any pointers / advise would be great!!!

The regex above may have not copy/paste correctly

0 Karma

mikaelbje
Motivator

Hi,

could you paste on raw Cisco IOS event from your Splunk server? I'll check why it doesn't match the provided regex in the app. If you're receiving syslog on TCP that could be the cause. I'll try to get that supported if you can get me some samples of your logs.

Regards,

Mikael

0 Karma

lukejadamec
Super Champion

To enter code that shows all characters, you can use the 010101 button, or bracket it in back quotes ```.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...