I noticed that some fields within the Splunk for Symantec sourcetype=symantec:ep:security:file is not being properly extracted. For example, the Applications_Name field has time values:
begin_Time has protocol values:
as well as some other fields with values that aren't matching up. Anyone else having this issue?
I do not believe these are fields that come with this app; they do not exist on my deployment, nor was I able to find "Applications_Name" anywhere in my servers.
I suspect these fields may have been locally grown, I suggest looking up their attributes/owner under field settings.