App for Symantec -Incorrect fields for Sep12:agent

[dpirolotvc]

I setup the App and TA per the documentation and applied the .conf files but the fields for the SEP12:Agent don't seem correct.

For example, the 'time stamp' field from the scm_agent.tmp file is mapped to the 'dest' field in splunk as well as the 'dest_nt_host' field. I've been looking over how this is configured, but figured I'd find out if there is any additional information about this before hacking it up.

This is only sourcetype that appears to be incorrect.

[sowings · Accepted solution]

You're right. I believe that the TA is currently written against version 11 of the SEP output. You'd have to update the list of fields in transforms.conf to reflect the new fields and their order. I've notified the product team so that the next app refresh should be updated to parse SEP 12. Until then, you'll have to create a local customization for the field extractions.

[dpirolotvc]

I started going through the transform.conf and props.conf and it does seem to be missing some fields. Looking forward to an update.