https://community.splunk.com/t5/Getting-Data-In/Sophos-Central-SC4S/m-p/552907#M91690 <P>Hi,</P><P>I am currently working on getting our Sophos Central Cloud logs into SPLUNK. I have the 1st step out of the way in that I have the logs being ingested fine. I am however having some difficulty in getting them into the correct index.</P><P>Following the documentation here:&nbsp;<A href="https://splunk-connect-for-syslog.readthedocs.io/en/latest/configuration/" target="_blank" rel="noopener">Configuration - Splunk Connect for Syslog (splunk-connect-for-syslog.readthedocs.io)</A>&nbsp;I am planning to add the following to to the&nbsp;splunk_metadata.csv:</P><P><EM>sophos_sophos central_Event::Endpoint::UpdateSuccess,sourcetype,sophos:endpoint:update:cef,index,sophos</EM></P><P><BR /><EM>sophos_sophos central_Event::Endpoint::WebControlViolation,sourcetype,sophos:endpoint:update:cef,index,sophos</EM></P><P>Based off the following 2 examples, do these appear correct?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk1.JPG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14299i7C4465D9BF89A252/image-size/large?v=v2&amp;px=999" role="button" title="splunk1.JPG" alt="splunk1.JPG" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk2.JPG" style="width: 687px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14298i35BF08D23DC6B72E/image-size/large?v=v2&amp;px=999" role="button" title="splunk2.JPG" alt="splunk2.JPG" /></span></P><P>&nbsp;</P><P>Many thanks</P><P>Shaun</P> Tue, 25 May 2021 08:19:35 GMT Shaun-Crouch 2021-05-25T08:19:35Z https://community.splunk.com/t5/Getting-Data-In/Sophos-Central-SC4S/m-p/552907#M91690 <P>Hi,</P><P>I am currently working on getting our Sophos Central Cloud logs into SPLUNK. I have the 1st step out of the way in that I have the logs being ingested fine. I am however having some difficulty in getting them into the correct index.</P><P>Following the documentation here:&nbsp;<A href="https://splunk-connect-for-syslog.readthedocs.io/en/latest/configuration/" target="_blank" rel="noopener">Configuration - Splunk Connect for Syslog (splunk-connect-for-syslog.readthedocs.io)</A>&nbsp;I am planning to add the following to to the&nbsp;splunk_metadata.csv:</P><P><EM>sophos_sophos central_Event::Endpoint::UpdateSuccess,sourcetype,sophos:endpoint:update:cef,index,sophos</EM></P><P><BR /><EM>sophos_sophos central_Event::Endpoint::WebControlViolation,sourcetype,sophos:endpoint:update:cef,index,sophos</EM></P><P>Based off the following 2 examples, do these appear correct?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk1.JPG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14299i7C4465D9BF89A252/image-size/large?v=v2&amp;px=999" role="button" title="splunk1.JPG" alt="splunk1.JPG" /></span></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="splunk2.JPG" style="width: 687px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14298i35BF08D23DC6B72E/image-size/large?v=v2&amp;px=999" role="button" title="splunk2.JPG" alt="splunk2.JPG" /></span></P><P>&nbsp;</P><P>Many thanks</P><P>Shaun</P> Tue, 25 May 2021 08:19:35 GMT https://community.splunk.com/t5/Getting-Data-In/Sophos-Central-SC4S/m-p/552907#M91690 Shaun-Crouch 2021-05-25T08:19:35Z