Cisco ASA, PIX and FWSM logs to seperate indexes?

[kearaspoor]

We're successfully pulling in logs from our Cisco ASA devices via syslog and have previously hard coded them to be sourcetype cisco:asa through the inputs.conf file using a monitor stanza to track the directory syslog routes them to.

Recently been made aware that this syslog data-stream contains different data-types which, because they're all labeled as ASA, are being parsed incorrectly. I figured out that the Splunk_TA-cisco_asa app will split them into ASA, PIX and FWSM sourcetypes if we change the inputs.conf to sourcetype=syslog

But I'm wondering how to get the ASA, PIX and FWSM types routed to separate indexes.

According to this:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Configurationparametersandthedatapipeline
props/transforms that set sourcetype occur before indexing.

And this:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Propsconf
which specifies: "* Routing specific events to a particular index, when you have multiple indexes."

and this:
http://docs.splunk.com/Documentation/Splunk/6.5.1/Admin/Transformsconf
which specifies: "* Routing specific events to a particular index, when you have multiple indexes."

makes me also believe that it should be possible to split the data into ASA, PIX and FWSM and then route them to different indexes.

But neither the props.conf or transforms.conf documentation provides the stanza or the syntax that should be used to set index after sourcetype is extracted.

Thank you!

[bmacias84]

This is super simple you just need to create your transforms and update the props.conf. I recommend you read Routing and and Filter data http://docs.splunk.com/Documentation/Splunk/6.5.1/Forwarding/Routeandfilterdatad. This needs to be done on the indexer or heavy forwarder.

#Transform
[PIX_Index]
DEST_KEY = _MetaData:Index
FORMAT = PIX
REGEX = %PIX-\d-\d{6}

[FWSM_Index]
DEST_KEY = _MetaData:Index
FORMAT = FWSM
REGEX = %FWSM-\d-\d{6}

[ASA_Index]
DEST_KEY = _MetaData:Index
FORMAT = ASA
REGEX = %ASA-\d-\d{6}

Now update your props.conf.

#props.conf
[source::tcp:514]
TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm,PIX_Index,FWSM_Index,ASA_Index

[source::udp:514]
TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm,PIX_Index,FWSM_Index,ASA_Index

[syslog]
TRANSFORMS-force_sourcetype_for_cisco = force_sourcetype_for_cisco_asa,force_sourcetype_for_cisco_pix,force_sourcetype_for_cisco_fwsm,PIX_Index,FWSM_Index,ASA_Index