Getting Data In

Cisco Ironport Web Security Appliance

egruenter
New Member

I created a data input on Port 514/UDP and the data goes to an index called "cisco_ironport_wsa" and I set the sourcetype to "cisco_wsa_squid" manually. Unfortunately I don't see anything if I choose one of the saved searches. Any idea?

Splunkversion 4.3.3, build 128297

Tags (1)
0 Karma

hheile
New Member

same here.. we changed to ftp transfer logfiles instead, which seems to work

0 Karma

egruenter
New Member

Today we did a few test again and we found that Syslog over TCP or UDP doesn't work with the Cisco Ironport Web Security App. If we use a file monitor as input we got it running. Anynone who knows about that issue?

0 Karma

MarioM
Motivator

are you sure your WSA is in wsa_squid format? WSA can be in different format ie cisco_wsa_squid, cisco_wsa_w3c...

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...