Cisco ESA Add-On Not Parsing

b3aggressive · ‎08-04-2020

A log subscription is set on the Cisco ESA appliance (IronPort Text Mail Logs) which is set to forward to a syslog-ng server, which then writes to a unique file. The inputs.conf is configured to monitor the file path. Splunk ingests the data, but fields are not extracting.

Has anyone ran into this issue and has a workaround?

richgalloway · ‎08-04-2020

Have you installed the Cisco ESA app on the indexers and search heads?

---
If this reply helps you, Karma would be appreciated.

Cisco ESA Add-On Not Parsing

inputs.conf

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Join the Conversation

Cisco ESA Add-On Not Parsing

inputs.conf

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...