Cisco ESA Add-On Not Parsing

b3aggressive · ‎08-04-2020

A log subscription is set on the Cisco ESA appliance (IronPort Text Mail Logs) which is set to forward to a syslog-ng server, which then writes to a unique file. The inputs.conf is configured to monitor the file path. Splunk ingests the data, but fields are not extracting.

Has anyone ran into this issue and has a workaround?

richgalloway · ‎08-04-2020

Have you installed the Cisco ESA app on the indexers and search heads?

---
If this reply helps you, Karma would be appreciated.

Cisco ESA Add-On Not Parsing

inputs.conf

Splunk Observability for AI

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Splunk Observability as Code: From Zero to Dashboard

Are you a member of the Splunk Community?

Cisco ESA Add-On Not Parsing

inputs.conf

Splunk Observability for AI

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Splunk Observability as Code: From Zero to Dashboard