TA_Fortinet add on not extracting fields properly

[spaniard047]

I installed the Splunk CIM and TA app with the goal being to upload .log files from FGTA devices. I have several from webfilter, evpn, and traffic. None of the default fgt_* sourcetypes extract fields properly. All I get is time extraction and "Event".

How can I correct this?

[vinod94]

Hi @spaniard047 ,

Where have you installed the addon? The addon should be on search head, indexer and forwarder.

[spaniard047]

Yes I have it installed on my local system.