Cisco ESA Add-On Not Parsing

b3aggressive · ‎08-04-2020

A log subscription is set on the Cisco ESA appliance (IronPort Text Mail Logs) which is set to forward to a syslog-ng server, which then writes to a unique file. The inputs.conf is configured to monitor the file path. Splunk ingests the data, but fields are not extracting.

Has anyone ran into this issue and has a workaround?

richgalloway · ‎08-04-2020

Have you installed the Cisco ESA app on the indexers and search heads?

---
If this reply helps you, Karma would be appreciated.

Cisco ESA Add-On Not Parsing

inputs.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Manage Edge Processor pipelines end to end with APIs

Splunk Brings Proof of Control to Digital Asset Transfers

Manage Ingest Processor pipelines end to end with APIs

Join the Conversation

Cisco ESA Add-On Not Parsing

inputs.conf

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Manage Edge Processor pipelines end to end with APIs

Splunk Brings Proof of Control to Digital Asset Transfers

Manage Ingest Processor pipelines end to end with APIs