Hello All,
has anyone used this add-on? has anyone got it to work?
I have followed the directions posted her:https://docs.splunk.com/Documentation/AddOns/released/Squid/Setup
I have a remote virtual machine that is our squid/proxy. I have splunk forwarder installed on it. I am using the "free" splunk server. I have installed the splunk universal forwarder on the squid/proxy. it forwards data to my free splunk. I configured my squid.conf file for both the recommened logformat and the standard format. I only get garbage - cooked data, etc no squid fields like "src_ip" etc. Can I assume this just does not work - and just forward the squid log via syslog-ng, etc.
Please let me know,
Thanks
Eric W.
