So we are trying to implement the SecureAuth IdP app in our environment. We are able to get log files to generate out from SecureAuth, but when we are ingesting them into splunk no meaningful fields are extracted.
Currently in SecureAuth, we are using version 8.2, we have the "Syslog" option selected for Audit Logs, and when the file is ingested, we do not match up with any of the extractions in props.conf. Has anyone else had this issue, or know if there is a setting in SecureAuth to make the log file match the format splunk is expecting?
... View more