https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53060#M10246 <P>are you sure your WSA is in <CODE>wsa_squid</CODE> format? WSA can be in different format ie <CODE>cisco_wsa_squid</CODE>, <CODE>cisco_wsa_w3c</CODE>...</P> Thu, 06 Sep 2012 14:40:46 GMT MarioM 2012-09-06T14:40:46Z https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53059#M10245 <P>I created a data input on Port 514/UDP and the data goes to an index called "cisco_ironport_wsa" and I set the sourcetype to "cisco_wsa_squid" manually. Unfortunately I don't see anything if I choose one of the saved searches. Any idea? </P> <P>Splunkversion 4.3.3, build 128297 </P> Mon, 28 Sep 2020 12:23:26 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53059#M10245 egruenter 2020-09-28T12:23:26Z https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53060#M10246 <P>are you sure your WSA is in <CODE>wsa_squid</CODE> format? WSA can be in different format ie <CODE>cisco_wsa_squid</CODE>, <CODE>cisco_wsa_w3c</CODE>...</P> Thu, 06 Sep 2012 14:40:46 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53060#M10246 MarioM 2012-09-06T14:40:46Z https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53061#M10247 <P>Today we did a few test again and we found that Syslog over TCP or UDP doesn't work with the Cisco Ironport Web Security App. If we use a file monitor as input we got it running. Anynone who knows about that issue? </P> Fri, 07 Sep 2012 16:10:05 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53061#M10247 egruenter 2012-09-07T16:10:05Z https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53062#M10248 <P>same here.. we changed to ftp transfer logfiles instead, which seems to work</P> Wed, 28 Aug 2013 08:52:17 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-Ironport-Web-Security-Appliance/m-p/53062#M10248 hheile 2013-08-28T08:52:17Z