All Apps and Add-ons

Parsing ASA-5-304001: properly

jcooperFossil
Path Finder

I was getting some error messages about Splunk being unable to parse the timestamp. I tracked it down to %ASA-5-304001 because it contains multiple lines, and each line is treated as a separate line entry, and only the first line has the timestamp, therefore, no timestamp to parse.
Example of the event:

May 21 14:46:52 FWHOSTNAME : %ASA-5-304001: 192.168.20.59 Accessed URL 52.94.232.32:http://52.94.232.32/x/ae12848777b41970a5f2 HTTP/1.1
Host: s.amazon-adsystem.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.181 Safari/537.36
Accept: image/webp,image/apng,image/,/*;q=0.8
Referer: http://gslbeacon.lijit.com/beacon

Do I need to create a new transforms.conf entry so this specific event code is line merged? I'm using the Splunk Add-On for Cisco ASA in Splunk Cloud.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...