All Apps and Add-ons

After installing the Splunk Add-on for Cisco ESA on our indexers, why are we getting splunkd.log warnings that several transforms are missing?

Path Finder

We installed the Splunk_TA_cisco-esa app on our indexers and I noticed in the splunkd.log that there are several transforms missing. I am not sure if the earlier versions of this app have the transforms and weren't migrated in the new versions. Does anyone know what these transforms should be?

Below are the missing transforms:

dest_host_for_cisco_esa
x_internal_message_id_for_cisco_esa
dvc_for_cisco_esa

Below are the errors on our indexers:

WARN SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='dest_host_for_cisco_esa'
WARN SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='x_internal_message_id_for_cisco_esa'
WARN SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='dvc_for_cisco_esa'

Splunk Employee
Splunk Employee

They're there in the add-on... how are you installing it?

-bash-4.1$ find splunk/etc/apps/Splunk_TA_cisco-esa/default/ -name *.conf | xargs grep dest_host_for_cisco_esa | wc -l
3
-bash-4.1$ find splunk/etc/apps/Splunk_TA_cisco-esa/default/ -name *.conf | xargs grep x_internal_message_id_for_cisco_esa | wc -l
1
-bash-4.1$ find splunk/etc/apps/Splunk_TA_cisco-esa/default/ -name *.conf | xargs grep dvc_for_cisco_esa | wc -l
1
-bash-4.1$ 
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!