This TA was developed from a limited sample dataset from an ArubaOS syslog source The TA should be compatible with ArubaOS 6.x-7.x at of 03 May 2018 Field extractions were based on documentation from Aruba available at ArubaOS 7.4 Syslog Message Reference Guide https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=15307 As my sample logs had a different timestamp format than the documentation indicates, you may need to adjust your TIME_FORMAT variable in props.conf. My sample files looked like May 3 12:09:09 2018 Where as the documentation indicates a format of May 3 12:09:09 I included a commented out value for TIME_FORMAT that matches the documented version