Hello all, We are connecting to our McAfee database using the McAfee Add-on 2.2.1 and DBConnect 3.3.1. The search reads perfectly; however, the McAfee database timestamps are in UTC time. On the database connection, we have defined our timezone as Canada/Eastern: -04:00. However, the timestamps are still shown in UTC time. I was expecting the timestamps to be converted by DB Connect to the actual timezone where they're in. Is there any way to do that? Btw I've tried the solutions in answer 612262 and 620601 to no avail: Setting correct timezone for mcafee logs in dbconnect: https://answers.splunk.com/answers/612262/index.html How can I override the timezone for Splunk DBX 3.1?: https://answers.splunk.com/answers/620601/index.html Thanks all, Pablo ... View more

Hello All, I am trying to configure McAfee ePO to send syslogs to Splunk; ePO requires the use of SSL. I've tried to configure an SSL input on port 6514 for TCP - syslog, and followed all the steps found in the web / manuals / etc. but I can't seem to be able to get this to work. Here's my question: Where can I find logs that show the detail of the SSL negotiation with the remote host, and what is failing? Thanks all, Pablo ... View more