Handling Cisco ISE Repeated Step Fields in Splunk and Cribl Stream

Symptom

When sending Cisco ISE syslog events that contain multiple Step= fields within a single event, only a single Step value is retained. The remaining Step values are not preserved as multi-value data and appear to be overwritten or discarded.

Environment

• Cisco ISE generating syslog authentication/authorization events
• Splunk Enterprise or Splunk Cloud as the analytics platform
• Cribl Stream in the data path (syslog in, Splunk indexers or Splunk HEC out)
• Cisco ISE Technology Add-on (TA) for Splunk

Resolution

1. Decide where to handle the repeated Step fields based on how data is being delivered to Splunk:

   • If sending raw syslog from Cisco ISE (with or without Cribl Stream in the middle), configure Splunk to treat Step as a multivalue field using MV_ADD = true at index time or a search-time rex with max_match=0.

   • If sending structured JSON via HEC from Cribl Stream, normalize repeated Step values into a JSON array before sending to Splunk, so that Step is ingested as a multivalue field.

2. For raw syslog into Splunk (recommended, lowest risk):

   1. Create or update a transforms.conf stanza to extract Step as a multivalue field:

      # transforms.conf
[ise_step_extract]
REGEX = Step=(\d+)
FORMAT = Step::$1
MV_ADD = true

   2. In props.conf for the Cisco ISE sourcetype (for example, cisco:ise:syslog), reference this transform:

      # props.conf

[cisco:ise:syslog]

REPORT-step = ise_step_extract

   3. Restart or reload Splunk as appropriate so the new extraction takes effect.

   4. Verify in Splunk search that Step appears as a multivalue field, for example:

      index=<IndexName> sourcetype=cisco:ise:syslog

| stats values(Step) as Step by _time host

      You should see all ISE Step values in a single event (for example, Step = 11001 11017 15049 22072).

3. For search-time-only extraction (when index-time changes are not possible):

   1. In Splunk search, extract Step as a multivalue field using rex:

      index=<IndexName> sourcetype=cisco:ise:syslog

| rex max_match=0 "Step=(?<Step>\d+)"

| stats values(Step) as Step by _time host

   2. Use this pattern in saved searches or dashboards where multivalue Step is required, understanding that this is a search-time workaround and can be more expensive at scale than index-time extraction.

4. For structured JSON delivery through Cribl Stream into Splunk HEC:

   1. In Cribl Stream, parse the raw ISE syslog and extract all occurrences of Step=<number> from _raw.

   2. Use a function (for example, a JavaScript or code function in a pipeline) to build an array from all matches and assign it to a Step field in the event:

      const matches = __e['_raw'].match(/Step=(\d+)/g);

if (matches) {

  __e['Step'] = matches.map(m => m.replace('Step=', ''));

}

   3. Ensure the Cribl route to Splunk HEC is configured to send events as JSON so that the Step array is preserved.

   4. In Splunk, confirm that Step is ingested as a multivalue field directly from the JSON payload without additional extraction.

5. Avoid renaming repeated Step fields into unique names (for example, Step{0}, Step{1}, Step{2}) unless there is a strong schema requirement to do so. Renaming can break compatibility with the Cisco ISE TA and other content that expects a single Step field with multivalue semantics.

Cause

This can be caused by:

• Cisco ISE emitting the same field name (Step) multiple times in a single syslog event.
• Default Splunk key-value extraction behavior only preserving a single value for a repeated field name when multivalue accumulation (MV_ADD) is not configured.
• Forwarding Cisco ISE events through Cribl Stream without normalizing repeated Step values when using structured JSON delivery to Splunk HEC.

Additional Information

• When using the Cisco ISE TA, confirm which sourcetypes and field extractions it defines for Step fields, and adjust props.conf and transforms.conf in line with the TA’s expectations.
• For lowest risk and maximum compatibility with Splunk add-ons, keep the raw event shape unchanged and solve multivalue handling on the Splunk side when possible.
• Normalizing to arrays in Cribl Stream is a good fit when the environment is already standardized on structured JSON delivery and downstream consumers expect or prefer JSON arrays for repeated values.
• These regexes assume Step= is always immediately followed by digits with no whitespace (e.g., Step=11001). If there's ever a space like Step= 11001, you'd need Step=\s*(\d+). Based on standard Cisco ISE syslog formatting, there is no space, so the current patterns are correct as-is.