Need assistance on Cisco dot1x msg filteration for ios

[malaka-kahingalage]

Hi All,

I'm looking to filter out cisco:ios messages for the DOT1X-5-FAIL failures. but whatever I do I can't get this filter to work. wondering if you can share some assistance, not raising this as an issue as I'm pretty sure this is something wrong I'm doing.

sc4s version=2.34.2

Msg: 325569: 10.xx.xx.xx: Mar  8 13:56:16.350 WST: %DOT1X-5-FAIL: Switch 2 R0/0: smd:  Authentication failed for client (XXXX.XXXX.XXXX) on Interface Gi2/0/14 AuditSessionID XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
13:56:17.504776 IP (tos 0x0, ttl 248, id 63387, offset 0, flags [none], proto UDP (17), length 257)

filters I tried...

file location : /opt/sc4s/local/config/filters

1st

file : cisco_ios_dot1x-postfilter.conf

block parser cisco_ios_dot1x-postfilter() {
  channel {
        rewrite(r_set_dest_splunk_null_queue);
   };
};

application cisco_ios_dot1x-postfilter[sc4s-postfilter] {
  filter {
    match('cisco', value('fields.sc4s_vendor') type(string))
    and match('ios', value('fields.sc4s_product') type(string))
	and message("%DOT1X-5-FAIL:" type(string) flags(substring))
	and message("Authentication failed for client" type(string) flags(substring));
  };
  parser { cisco_ios_dot1x-postfilter(); };
};

2nd

file : cisco_ios_dot1x-postfilter.conf

block parser cisco_ios_dot1x-postfilter() {
  channel {
        rewrite(r_set_dest_splunk_null_queue);
   };
};

application cisco_ios_dot1x-postfilter[sc4s-postfilter] {
  filter {
		message("%DOT1X-5-FAIL:" type(string) flags(substring))
	and message("Authentication failed for client" type(string) flags(substring));
  };
  parser { cisco_ios_dot1x-postfilter(); };
};

3rd

file : cisco_ios_dot1x-postfilter.conf

block parser cisco_ios_dot1x-postfilter() {    
    channel {                    
        rewrite { 
            r_set_splunk_dest_update(
                vendor('null') product('queue')
            );
        };
   };
};
application cisco_ios_dot1x-postfilter[sc4s-postfilter] {
 filter { 
        "${fields.sc4s_vendor_product}" eq "cisco_ios"
        and message("DOT1X-5-FAIL" type(string) flags(substring)));
    }; 
    parser { cisco_ios_dot1x-postfilter(); };   
};

4th

file : cisco_ios_dot1x-postfilter.conf

block parser cisco_ios_dot1x-postfilter() {
    channel {
        rewrite(r_set_dest_splunk_null_queue);
   };
};
application cisco_ios_dot1x-postfilter[sc4s-postfilter] {
 filter {
        "${fields.sc4s_vendor}" eq "cisco" and
        "${fields.sc4s_product}" eq "ios" and
        message('DOT1X-5-FAIL');
    };
    parser { cisco_ios_dot1x-postfilter(); };
};

[rjha-splunk]

We missed out this , is it something still valid, If Yes we will request you to create a github issue.