All Apps and Add-ons

getting Splunk, CyberArk, and Syslog-ng working together

cameronr0705
New Member

We setup a centralized syslog-ng server. We are receiving logs from multiple different sources without issue. The logs from CyberArk Vault server are the only logs delayed an hour or more with no line breaks for new lines. The Splunk CyberArk TA is installed on the syslog server and the search head. It does not appear logs are being parsed when sent to Splunk as expected. Any help would be appreciated.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...