Hey All,
I have installed the Proofpoint Email Security Add-On for Splunk (TA) on my Universal Forwarder's that collect the Syslog from Proofpoint.
I have also installed the Proofpoint Email Security Add-On for Splunk (TA) on my Search Head Cluster and installed the Proofpoint Email Security App for Splunk (App) on my search head cluster.
All of the dashboards are not populating in the app. I did some investigation and noticed the search macro for the app was setup to point to the wrong index. I modified the search macro to point to the right index where our logs are stored (index=proofpoint).
I verified the search macro returns results without the sourcetype
Need some assistance in figuring out why the app isn't actually extracting the sourcetypes from the pps_log sourcetype
See below from the app page:
Verification
PPS filter and mail logs are collected by the source type "pps_log" and are mapped to sourcetypes pps_filter_log and pps_mail_log. In the search box you can verify the logs by search for sourcetype="pps_filter_log" and "sourcetype="pps_mail_log
I don't see any other sourcetype than pps_log.
It appears the transforms does have the correct regex as I tested it against some log entries but it's not actually creating the other sourcetypes.
Does anyone have any recommendations?
Thanks!
Andrew
