We had a discussion with a SPLUNK ES engineer and we installed the Splunk_TA_bluecoat app and using the stanza's in that app.
We are trying to get cs_categories moved to a multivalue field call category and we found that the props.conf and tranforms.conf have this code but we are not having any luck.
our source type is bluecoat:proxysg:access:kv
source =tcp:bluecoat
I am also guessing that REPORT keyword is only used when searching?
props.conf:
[bluecoat:proxysg:access:kv]
pulldown_type = true
category = Network & Security
description = Data from Blue Coat ProxySG in W3C ELFF format thru syslog
KV_MODE = auto
SHOULD_LINEMERGE = false
MAX_DAYS_AGO = 10951
EVENT_BREAKER_ENABLE = true
TRUNCATE = 64000
TRANSFORMS-TrashHeaders = TrashHeaders
SEDCMD-empty=s/ [a-zA-z0-9-]+=-//g
REPORT-categories = bluecoatkv_categories
transforms.conf:
[bluecoatkv_categories]
SOURCE_KEY = cs_categories
REGEX = (?[^;]+)
MV_ADD = true
