https://community.splunk.com/t5/Getting-Data-In/TrendMicro-deepdicovery-app-settings/m-p/576683#M101884 <P>Hello Team,</P><P>I am trying to setup the TrendMicro DeepDiscovery app to process the DDA/DDI events. I also have TrendMicro IWSVA hosts. After the app is installed in SH, I am redirected to the app setup page. Ihave replaced the default index in <SPAN>Deep Discovery Event Type&nbsp;</SPAN>i.e. ddi_index with the index that I had created with custom inputs. Similarly i have replaced the index name for&nbsp;<SPAN>Web Access Log Event Type as well with new index name. But the logs with sourcetype"squid"are still going to the default index log_index. Can someone suggest how we can troubleshoot it. Also, can someone suggest what should be the sourcetype for the DDA/DDI and IWSVA logs.</SPAN></P><P>&nbsp;</P><P><SPAN>Any help/suggestion is helpful.</SPAN></P><P><SPAN>Thanks</SPAN></P> Tue, 30 Nov 2021 06:04:28 GMT bbiswabhusan 2021-11-30T06:04:28Z https://community.splunk.com/t5/Getting-Data-In/TrendMicro-deepdicovery-app-settings/m-p/576683#M101884 <P>Hello Team,</P><P>I am trying to setup the TrendMicro DeepDiscovery app to process the DDA/DDI events. I also have TrendMicro IWSVA hosts. After the app is installed in SH, I am redirected to the app setup page. Ihave replaced the default index in <SPAN>Deep Discovery Event Type&nbsp;</SPAN>i.e. ddi_index with the index that I had created with custom inputs. Similarly i have replaced the index name for&nbsp;<SPAN>Web Access Log Event Type as well with new index name. But the logs with sourcetype"squid"are still going to the default index log_index. Can someone suggest how we can troubleshoot it. Also, can someone suggest what should be the sourcetype for the DDA/DDI and IWSVA logs.</SPAN></P><P>&nbsp;</P><P><SPAN>Any help/suggestion is helpful.</SPAN></P><P><SPAN>Thanks</SPAN></P> Tue, 30 Nov 2021 06:04:28 GMT https://community.splunk.com/t5/Getting-Data-In/TrendMicro-deepdicovery-app-settings/m-p/576683#M101884 bbiswabhusan 2021-11-30T06:04:28Z