Re: Cisco ESA Add-On Not Parsing

b3aggressive · ‎08-04-2020

A log subscription is set on the Cisco ESA appliance (IronPort Text Mail Logs) which is set to forward to a syslog-ng server, which then writes to a unique file. The inputs.conf is configured to monitor the file path. Splunk ingests the data, but fields are not extracting.

Has anyone ran into this issue and has a workaround?

richgalloway · ‎08-04-2020

Have you installed the Cisco ESA app on the indexers and search heads?

---
If this reply helps you, Karma would be appreciated.

Cisco ESA Add-On Not Parsing

inputs.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Fuel Your Journey: What’s Waiting for You at the .conf26 Acceleration Station

Join the Final Session of the Data Management & Federation Bootcamp Series

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation