All Apps and Add-ons

How to remove slashes from ACS or ISE logs?

awurster
Contributor

not so much a question... more of an answer.

i had a lot of log messages with slashes before the field separating commas. something like:

2015-01-05T14:47:25+00:00 acs02 CSCOacs_Passed_Authentications 0014607956 6 5  ExternalGroups=cn=my-group\,ou=Groups\,dc=my-org\,dc=com, ...

ACS version is acs-5.5.0.46-B.723. splunk 6.1.3 and TA for ACS is the latest.

1 Solution

awurster
Contributor

i've added the following line to my props.conf to clean that event data from ACS logs. same trick i used from an old version of the ISE app. i'm fairly certain it's a bug / enhancement on the cisco side for both products.

[cisco:acs]
SEDCMD-clean_logs = s/\\\,/,/g

View solution in original post

awurster
Contributor

i've added the following line to my props.conf to clean that event data from ACS logs. same trick i used from an old version of the ISE app. i'm fairly certain it's a bug / enhancement on the cisco side for both products.

[cisco:acs]
SEDCMD-clean_logs = s/\\\,/,/g

dshpritz
SplunkTrust
SplunkTrust

Nice work. I haven't seen this in the samples that I have. You may want to edit this question to have a a question like "How can I remove these slashes from my ACS logs?" and then answer it. That way we can upvote it and it can be marked as answered!

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...