Getting Data In

macros in Cisco ASA app don't seem to exist?

jfraiberg
Communicator

I am having issues with the following macros -

[macros/conf-change]
access = read : [ * ], write : [ admin, power ]
export = system
owner = admin
version = 4.3.1
modtime = 1342048716.612678000

[macros/conf-change-user%281%29]
access = read : [ * ], write : [ admin, power ]
export = none
owner = admin
version = 4.3.1
modtime = 1342050821.201532000

They don't seem to exist.

Tags (1)
0 Karma

kenth
Splunk Employee
Splunk Employee

The macros are in the TA-cisco_asa in macros.conf !

0 Karma

jfraiberg
Communicator

I was able to fix it by downloading and older version which has the macros.conf.

[conf-change]
definition = index=main eventtype=command-exec | transaction user startswith="configure terminal" endswith="write memory"
iseval = 0

[conf-change-user(1)]
args = user
definition = index=main eventtype=command-exec user=$user$ | transaction username startswith="configure terminal" endswith="write memory"
iseval = 0

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...