https://community.splunk.com/t5/Security/Cisco-Ironport-Searches/m-p/50541#M1658 <P>What index is the data going in to? I noticed I had to have mine in the "cisco_wsa" index for it to work.</P> Wed, 15 Sep 2010 19:48:00 GMT treinke 2010-09-15T19:48:00Z https://community.splunk.com/t5/Security/Cisco-Ironport-Searches/m-p/50540#M1657 <P>I am trying to run the searches that come with the Ironport Web Security portion of Cisco Security for Splunk, and nothing come up. The logs are being indexed because I can search on eventtype="ironport_proxy", but the prepackaged searches do not impart data. Has anyone had any experience with this? Cheers.</P> Wed, 15 Sep 2010 03:55:54 GMT https://community.splunk.com/t5/Security/Cisco-Ironport-Searches/m-p/50540#M1657 aatuckett 2010-09-15T03:55:54Z https://community.splunk.com/t5/Security/Cisco-Ironport-Searches/m-p/50541#M1658 <P>What index is the data going in to? I noticed I had to have mine in the "cisco_wsa" index for it to work.</P> Wed, 15 Sep 2010 19:48:00 GMT https://community.splunk.com/t5/Security/Cisco-Ironport-Searches/m-p/50541#M1658 treinke 2010-09-15T19:48:00Z