Versions
Splunk Enterprise v7.0.0
Cisco eStreamer eNcore v3.0.0
Problem
I currently have an issue where eStreamer data for IPS events are showing an incorrect value for sid in alert data. The majority of entries do have the correct sid value, but some don't. In the cases where it doesn't, there's a metadata record that shows up in the logs that provides an id field (showing up as sid in IPS events) and then the correct sid field. Here's an example:
eStreamer appears to be logging the correct sid everywhere else in our environment; Splunk is the only one that isn't.
Expected Result
Ideally, we would like to have IPS events have the actual sid in that field, not the internal database id.
Anyone happen to have a solution to this? Any help would be greatly appreciated.
