Try replacing the ':' in tags.conf with '_' ... View more

So I ended up with a different, kind of hacked together solution that works. I use Netwrix to collect and interpret the audit logs. It sends an email every 5 minutes. I have a perl script that reads the emails and writes to a log file that splunk reads. Kind of a hack, but it works. Netwrix is cheap and they do a lot of interpretation that I do not have to do. They are looking at providing a direct to log output in the future so I can drop the email/perl script bit. cheers, ski ... View more