Hi All,
I'm trying to install the Cisco ESA Add-on App https://splunkbase.splunk.com/app/1761/
However when setting this up in Cisco Security Suite, it doesn't recognize the app after I've uploaded it - please see screenshots.
It does however recognize it when configuring a data input, please could you advise?
Thanks!
the cisco:esa:legacy means you had an older version of the add-on installed before the source types were renamed to follow best practices, your events indexed with the older source types cisco_esa and cisco:esa are now searchable under this new source type.
About data not being visible the email dashboards, there rely on event type = cisco-esa. check your data and see if the event type is present. if you have the latest version of the add-on, they should be.
the eventtype uses this search
(sourcetype="cisco:esa:textmail" OR sourcetype=cisco:esa:legacy) AND (MID OR ICID OR DCID)
Try it and see if you get any results.
Hello, can you please advise on how you bypassed the original error, "No data found. Please install this add-on"?
I've got the ESA add-on app loaded and visible in Cisco Security Suite, however ESA logs appear in the main security suite dashboard (with cisco:esa:legacy sourcetype) but not in the 'email security' tab - any ideas on this please?
Thanks!