It appears something like this has happened before:
https://answers.splunk.com/answers/513608/major-problem-with-cisco-asa-add-on.html
I was able to find these strings in transforms.conf (Splunk_TA_cisco-asa):
[reverse_src_dest_for_outbound]
REGEX = [Oo]utbound\s+\S+\s+connection\s+\d+\s+for\s+\S+\s*:\s*([^\s\/\(]+)(?:\/(\w+))?(?:\((\S+)\))?\s*\(?([^\s\/\(]+)?\/?(\d+)?\)?\s+to\s+[^:]+:\s*([^\s\/\(]+)(?:\/(\w+))?(?:\((\S+)\))?\s*\(?([^\s\/\(]+)?\/?(\d+)?\)?
FORMAT = dest_ip::$1 dest_port::$2 dest_user::$3 dest_translated_ip::$4 dest_translated_port::$5 src_ip::$6 src_port::$7 src_user::$8 src_translated_ip::$9 src_translated_port::$10
This seems to handle the flipping of ASA-6-302013 and ASA-6-302015, but since ASA-6-302014 and ASA-6-302016 do NOT contain the word "outbound" in it, maybe it's getting caught by the normal src/dst REGEX:
[cisco_src_dest_ipv4]
REGEX = (?:(\S+)/)?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\((\d*)\)\s\->\s(?:(\S+)/)?(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})\((\d*)\)
FORMAT = src_zone::$1 src_ip::$2 src_port::$3 dest_zone::$4 dest_ip::$5 dest_port::$6
... View more