Not getting data

[amyers1616]

Not sure if I've left something configured incorrectly, but it doesn't seem as if this pulls any data. I'm using the Cisco ASA add-on for getting logs in to Splunk and also have the CIM add-on installed. Any suggestions for troubleshooting?

[enes-alatas]

Hello Aaron,

Thanks for using the app. First of all, we recommend you to confirm that your Cisco ASA logs are being correctly ingested in your Splunk environment. You can confirm that by a simple Splunk search like this:

index=<your_cisco_asa_index> sourcetype=cisco:asa

If the search does not produce any result, please check your configuration with the Splunk Cisco ASA Add-on documentation.

If you have any further question, please do not hesitate to contact us.

[amyers1616]

Hey Enes .. thanks for the tip. I do indeed see log data for this using the search string you provided. I'm running Splunk 8.1 and Firewall Rule Analysis 1.0.0.

Aaron

[enes-alatas]

Dear Aaron,

There might be another detail causing the issue. Could you check the CIM Network Traffic index whitelist and be sure that your Cisco ASA index is added to the list? You can follow the steps documented here.

[amyers1616]

It looks like it's fine but here's a screenshot anyway.

[enes-alatas]

Hello Aaron,

Yes, everything looks okay with your CIM setup. Could you also run the following search in order to check your data goes into the data model?

|tstats count from datamodel=Network_Traffic where sourcetype="cisco:asa"

In addition, there might be some compliance problems between your data and the data model. You can use this app to check CIM compliance.

[amyers1616]

Looks like it is getting in. Running your query produces results.

I'll give the app you suggested a try and report back.

[amyers1616]

Okay, I'm going to guess there is an issue with our data & data model. I ran a search in CIM Validator for "cisco:asa" and it has 0% CIM Compliance. Any pointers on where to look at documentation for fixing it?

[enes-alatas]

Hey Aaron,

Normally, Splunk Add-on for Cisco ASA should map your data to CIM Network Traffic data model. However, as far as I understand it can not map your data. I firstly recommend you to review its field extractions and aliases. If you can not troubleshoot the issue in the add-on. You can use Splunk Add-on Builder App and create your own technology add-on to map your data to Network Traffic data model. The related documentation article here may help you with this.