Proofpoint Email Security Add-On: Issues with dashboard population and extractions

[adalbor]

Hey All,
I have installed the Proofpoint Email Security Add-On for Splunk (TA) on my Universal Forwarder's that collect the Syslog from Proofpoint.
I have also installed the Proofpoint Email Security Add-On for Splunk (TA) on my Search Head Cluster and installed the Proofpoint Email Security App for Splunk (App) on my search head cluster.

All of the dashboards are not populating in the app. I did some investigation and noticed the search macro for the app was setup to point to the wrong index. I modified the search macro to point to the right index where our logs are stored (index=proofpoint).
I verified the search macro returns results without the sourcetype

Need some assistance in figuring out why the app isn't actually extracting the sourcetypes from the pps_log sourcetype
See below from the app page:

Verification

PPS filter and mail logs are collected by the source type "pps_log" and are mapped to sourcetypes pps_filter_log and pps_mail_log. In the search box you can verify the logs by search for sourcetype="pps_filter_log" and "sourcetype="pps_mail_log
I don't see any other sourcetype than pps_log.

It appears the transforms does have the correct regex as I tested it against some log entries but it's not actually creating the other sourcetypes.

Does anyone have any recommendations?

Thanks!
Andrew

[adalbor · Accepted solution]

I found the issue all, after talking with support they suggested it be installed on the indexers due to the props and transforms.

This resolved the issue instantly and the dashboards started populating right away.