After installing the Splunk Add-on for Cisco ESA on our indexers, why are we getting splunkd.log warnings that several transforms are missing?

[robert_miller]

We installed the Splunk_TA_cisco-esa app on our indexers and I noticed in the splunkd.log that there are several transforms missing. I am not sure if the earlier versions of this app have the transforms and weren't migrated in the new versions. Does anyone know what these transforms should be?

Below are the missing transforms:

dest_host_for_cisco_esa
x_internal_message_id_for_cisco_esa
dvc_for_cisco_esa

Below are the errors on our indexers:

WARN SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='dest_host_for_cisco_esa'
WARN SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='x_internal_message_id_for_cisco_esa'
WARN SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='dvc_for_cisco_esa'

[jcoates_splunk]

They're there in the add-on... how are you installing it?

-bash-4.1$ find splunk/etc/apps/Splunk_TA_cisco-esa/default/ -name *.conf | xargs grep dest_host_for_cisco_esa | wc -l
3
-bash-4.1$ find splunk/etc/apps/Splunk_TA_cisco-esa/default/ -name *.conf | xargs grep x_internal_message_id_for_cisco_esa | wc -l
1
-bash-4.1$ find splunk/etc/apps/Splunk_TA_cisco-esa/default/ -name *.conf | xargs grep dvc_for_cisco_esa | wc -l
1
-bash-4.1$