https://community.splunk.com/t5/Security/Bluecoat-proxy-integration/m-p/259516#M7120 <P>The Splunk Add-on for Blue Coat ProxySG expects the ProxySG log files in W3C ELFF format. So this wont work for your log format.</P> <P>You can try the AddOn for Squid PRoxy (<A href="https://splunkbase.splunk.com/app/2965/#/overview">https://splunkbase.splunk.com/app/2965/#/overview</A>) it is CIM compliant. </P> <P>Most likely the AddOn for Squid Proxy will get you close, but you will need to update the header fields and extractions to reflect the additional BlueCoat fields. * This also depends on what version of BlueCoat you have and what fields you have enabled on the appliances..</P> Wed, 07 Sep 2016 06:46:08 GMT esix_splunk 2016-09-07T06:46:08Z https://community.splunk.com/t5/Security/Bluecoat-proxy-integration/m-p/259515#M7119 <P>Hi ,</P> <P>I'm trying to integrate blue coat proxy with Splunk, however stuck at the below point.<BR /> The bluecoat proxy is sending its log in squid format through syslog to my indexer which app should i use ( TA- Blue coat or TA - Squid ) in order to make it CIM compatible.</P> Wed, 07 Sep 2016 06:26:57 GMT https://community.splunk.com/t5/Security/Bluecoat-proxy-integration/m-p/259515#M7119 himapate 2016-09-07T06:26:57Z https://community.splunk.com/t5/Security/Bluecoat-proxy-integration/m-p/259516#M7120 <P>The Splunk Add-on for Blue Coat ProxySG expects the ProxySG log files in W3C ELFF format. So this wont work for your log format.</P> <P>You can try the AddOn for Squid PRoxy (<A href="https://splunkbase.splunk.com/app/2965/#/overview">https://splunkbase.splunk.com/app/2965/#/overview</A>) it is CIM compliant. </P> <P>Most likely the AddOn for Squid Proxy will get you close, but you will need to update the header fields and extractions to reflect the additional BlueCoat fields. * This also depends on what version of BlueCoat you have and what fields you have enabled on the appliances..</P> Wed, 07 Sep 2016 06:46:08 GMT https://community.splunk.com/t5/Security/Bluecoat-proxy-integration/m-p/259516#M7120 esix_splunk 2016-09-07T06:46:08Z