https://community.splunk.com/t5/Getting-Data-In/Cisco-ESA-Add-On-Not-Parsing/m-p/512439#M86933 <P>A log subscription is set on the Cisco ESA appliance (IronPort Text Mail Logs) which is&nbsp;set to forward to a syslog-ng server, which then writes to a unique file. The inputs.conf is configured to monitor the file path. Splunk ingests the data, but fields are not extracting.</P><P>Has anyone ran into this issue and has a workaround?</P> Tue, 04 Aug 2020 19:53:17 GMT b3aggressive 2020-08-04T19:53:17Z https://community.splunk.com/t5/Getting-Data-In/Cisco-ESA-Add-On-Not-Parsing/m-p/512439#M86933 <P>A log subscription is set on the Cisco ESA appliance (IronPort Text Mail Logs) which is&nbsp;set to forward to a syslog-ng server, which then writes to a unique file. The inputs.conf is configured to monitor the file path. Splunk ingests the data, but fields are not extracting.</P><P>Has anyone ran into this issue and has a workaround?</P> Tue, 04 Aug 2020 19:53:17 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-ESA-Add-On-Not-Parsing/m-p/512439#M86933 b3aggressive 2020-08-04T19:53:17Z https://community.splunk.com/t5/Getting-Data-In/Cisco-ESA-Add-On-Not-Parsing/m-p/512445#M86934 Have you installed the Cisco ESA app on the indexers and search heads? Tue, 04 Aug 2020 20:25:00 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-ESA-Add-On-Not-Parsing/m-p/512445#M86934 richgalloway 2020-08-04T20:25:00Z