-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #345 from splunk/fix/cisco-asa
Cisco ASA conflict with Cisco IOS
- Loading branch information
Showing
7 changed files
with
114 additions
and
102 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| filter f_cisco_syslog{ | ||
| match("cisco_syslog", value("fields.sc4s_vendor_product") type(glob)); | ||
| }; | ||
| rewrite set_cisco_syslog{ | ||
| set("cisco_syslog" value("fields.sc4s_syslog_format")); | ||
| }; | ||
| filter f_is_cisco_syslog{ | ||
| match("cisco_syslog" value("fields.sc4s_syslog_format")) | ||
| }; | ||
|
|
||
| parser cisco-parser-ex{ | ||
| channel { | ||
| filter { | ||
| #message('^<\d*> ?(?:(\d+)\: )?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(\d+): )?(?:(\d\d:\d\d:\d\d|\d{1,6} \d{1,2}))?(?:(\*)?((?:\w\w\w {1,2}\d{1,2} (?:\d{2,4} )?\d\d:\d\d:\d\d)(?:\.\d{3,6})?( [AP]M)?)( [A-Z]{3,3})?)?( \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} )?: ((\%[^\: ]+)\:? ?.*)' flags(store-matches)); | ||
| message('^^<\d*> ?(?:(\d+)\: )?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(\d+): )?(?:(\d\d:\d\d:\d\d|\d{1,6} \d{1,2}))?(?:(\*)?((?:\w\w\w {1,2}\d{1,2} (?:\d{2,4} )?\d\d:\d\d:\d\d)(?:\.\d{3,6})?( [AP]M)?)( [A-Z]{3,3})?)? ?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]))? ?: ((\%[^\: ]+)\:? ?.*)' flags(store-matches)); | ||
| }; | ||
| if { | ||
| #Mar 4 11:45:20 | ||
| #Apr 29 13:58:46.000001 | ||
| #Apr 29 13:58:46.411 | ||
| #Mar 1 18:48:50.483 UTC NOTE: Reverse TZ "%Z" parsing will not work for non-local timezones. | ||
| # guess-timezone() will be used to reconcile timezones | ||
| parser { | ||
| date-parser(format( | ||
| '%b %d %H:%M:%S.%f', | ||
| '%b %d %H:%M:%S', | ||
| '%b %d %I:%M:%S %p.%f', | ||
| '%b %d %I:%M:%S %p', | ||
| '%b %d %Y %H:%M:%S.%f' | ||
| '%b %d %Y %H:%M:%S', | ||
| ) | ||
| template("$8") | ||
| flags(guess-timezone) | ||
| ); | ||
| }; | ||
| } else { | ||
| # rewrite { set("date/time parser failed", value("fields.sc4s_error")); }; | ||
| rewrite { set("date/time parser failed on string $8" value("fields.sc4s_error")); }; | ||
| }; | ||
| rewrite { | ||
| set( | ||
| "${4}", | ||
| value("HOST") | ||
| condition(match('..' value('4'))) | ||
| ); | ||
| set( | ||
| "${13}", | ||
| value("HOST") | ||
| condition(match('..' value('13'))) | ||
| ); | ||
| set( | ||
| "${15}", | ||
| value("PROGRAM") | ||
| ); | ||
| set( | ||
| "${14}", | ||
| value("MESSAGE") | ||
| ); | ||
| }; | ||
|
|
||
| }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,54 +1,3 @@ | ||
| # In general this will not be used; parser setting will override the need for this | ||
|
|
||
| filter f_cisco_ios{ | ||
| match("cisco_ios", value("fields.sc4s_vendor_product") type(glob)); | ||
| }; | ||
|
|
||
|
|
||
| parser cisco-parser-ex{ | ||
| channel { | ||
| filter { | ||
| #message('^<\d*>(?:(?<ciscoseq>\d+)\: )?(?:(?<HOST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(?<ciscorule>\d+): )?(?:(?<ciscotimereliable>\*)?(?<ciscotime>(?<time>\w\w\w {1,2}\d{1,2} \d\d:\d\d:\d\d)(?<ciscofrac>\.\d{3,6})? ?(?<ciscotz>\w+)?): )?(?:(?<ciscouptime>\d\d:\d\d:\d\d|\d{1,6} \d{1,2}): )?(?<cisomsg>(?<ciscoprogram>%.{2,15}\-\d{1,3}\-[^:]{3,}): (?<ciscodescription>.*))' flags(store-matches)); | ||
| message('^<\d*>(?:(\d+)\: )?(?:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9])\.)*([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9\-]*[A-Za-z0-9]): )?(?:(\d+): )?(?:(\*)?((?:\w\w\w {1,2}\d{1,2} (?:\d{2,4} )?\d\d:\d\d:\d\d)(?:\.\d{3,6})?( [AP]M)?)( \w+)?: )?(?:(\d\d:\d\d:\d\d|\d{1,6} \d{1,2}): )?(%.{2,15}\-\d{1,3}\-[^:]+): (.*)' flags(store-matches)); | ||
| }; | ||
| if { | ||
| #Mar 4 11:45:20 | ||
| #Apr 29 13:58:46.000001 | ||
| #Apr 29 13:58:46.411 | ||
| #Mar 1 18:48:50.483 UTC NOTE: Reverse TZ "%Z" parsing will not work for non-local timezones. | ||
| # guess-timezone() will be used to reconcile timezones | ||
| parser { | ||
| date-parser(format( | ||
| '%b %d %H:%M:%S.%f', | ||
| '%b %d %H:%M:%S', | ||
| '%b %d %I:%M:%S %p.%f', | ||
| '%b %d %I:%M:%S %p', | ||
| '%b %d %Y %H:%M:%S.%f' | ||
| '%b %d %Y %H:%M:%S', | ||
| ) | ||
| template("$7") | ||
| flags(guess-timezone) | ||
| ); | ||
| }; | ||
| } else { | ||
| # rewrite { set("date/time parser failed", value("fields.sc4s_error")); }; | ||
| rewrite { set("date/time parser failed on string $7" value("fields.sc4s_error")); }; | ||
| }; | ||
| rewrite { | ||
| set( | ||
| "$4", | ||
| value("HOST") | ||
| condition(match('..' value('4'))) | ||
| ); | ||
| set( | ||
| "$11", | ||
| value("PROGRAM") | ||
| ); | ||
| set( | ||
| "$12", | ||
| value("MSG") | ||
| ); | ||
| }; | ||
|
|
||
| }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters