topic Re: BlueCoat logs are not Processing in All Apps and Add-ons

BlueCoat logs are not Processing

Kaushikkatta03 — Mon, 18 Jul 2016 15:44:06 GMT

Hello ,

In our splunk environment ,blueCoat logs are getting into Forwarder, but they aren't getting into the indexer from the forwarder . can anyone help us in troubleshooting or to find where the Problem is .Thanks in advance .

Re: BlueCoat logs are not Processing

adamblock2 — Mon, 18 Jul 2016 15:49:57 GMT

Can you post additional information to help clarify your issue?

Are the logs being sent to syslog and then being forwarded to Splunk?
Are you using a heavy or universal forwarder?
Is the forwarder configured to forward other event logs or only BlueCoat? If the former, are the other event logs being properly forwarded to Splunk?
Have you tried stopping and restarting the forwarder service?

Thank you.

Re: BlueCoat logs are not Processing

Kaushikkatta03 — Mon, 18 Jul 2016 17:44:23 GMT

Hello Adam ,

We are using Heavy forwarder . the logs are being sent to syslog and then forwarded to heavy forwarder,from the forwarder the logs are unable to getting into Indexer.

It was yesterday morning around 5.45 am is the last updated and up to now we are unable to see any log being getting generated

Other event logs are being properly forwarded and indexed .

I have restarted the forwarder service and still unable to find the logs being updated .

-Thanks

Re: BlueCoat logs are not Processing

adamblock2 — Mon, 18 Jul 2016 17:51:59 GMT

Are the BlueCoat logs still being forwarded to the syslog server? Have you noticed errors in any of the log files (splunkd.log, etc.)?

Thank you.

Re: BlueCoat logs are not Processing

Kaushikkatta03 — Tue, 29 Sep 2020 10:19:51 GMT

hello Adam ,

This is the stanza we tried to execute and check for the logs

"[monitor:///opt/syslogs/proxy/...]
whitelist = .log$
sourcetype = bluecoat_syslog
index = net_proxy
host_segment = 4"

We have verified the splunkd.log , we cannot see any error in that .the data is getting injected but it is intermediate .

Is there any other way to fix it Permanently,

Re: BlueCoat logs are not Processing

Kaushikkatta03 — Wed, 20 Jul 2016 17:15:47 GMT

some times when I try to find the "bluecoat_syslogs" through the search head , i'm getting the logs sometimes and sometimes it gives 'no results found' . May i know why this is happening ,how to overcome the issue.