We're attempting to get Clearpass Insight logs into Splunk. We've had the Aruba ClearPass App for Splunk Enterprise app configured and in use for RADIUS logs, etc. for some time.
Current software versions are:
Splunk - Splunk Cloud 7.0.8.5
ClearPass Policy Manager 6.7.9
App - Aruba ClearPass App for Splunk Enterprise 2.0
We have configured our logging outputs per the "Supporting XML file for configuring ClearPass Syslog filters" http://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default....
I cannot see any reference in the above XML to Insight logs. In theory these would be 'clearpass_insight_logs'
Is there any support for Insight logs within the App/TA
How should the ClearPass Syslog filters be configured to support the above?
