Hi, is there any possibility to use http instead of https in the Splunk Add-on for cisco ucs? We have a problem with the strength of the certificate and cannot change it at this time. In the ta_cisco_ucs.log we get the following error: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ucs\bin\ta_util2\httplib2\__init__.py", line 1044, in connect raise SSLHandshakeError(e) SSLHandshakeError: [SSL: SSL_NEGATIVE_LENGTH] dh key too small (_ssl.c:604) So we would try to connect with http... Regards, Maik ... View more

Hello, I try to user props.conf to change the sourcetype (in this case from cisco:asa to something else) I've set up a props.conf and transforms.conf in the "local" folder. But this doesn't work at all. Here is the props.conf: [source::udp:514] TRANSFORMS-changesourcetype = syslog_ciscoesatextmail TRANSFORMS-changesourcetype = syslog_rsaauthmgr Here is the transforms.conf: [syslog_ciscoesatextmail] REGEX = :dds+(?:d+s+|(?:user|daemon|local.?).w+s+)*[?(10.1.1.152|10.1.1.153)[w.-]{2,})]?s FORMAT = sourcetype::cisco:esa:textmail DEST_KEY = MetaData:Sourcetype [syslog_rsaauthmgr] REGEX = :dds+(?:d+s+|(?:user|daemon|local.?).w+s+)*[?(10.1.1.24|10.1.1.25)[w.-]{2,})]?s FORMAT = sourcetype::RSA_AUTH_MGR DEST_KEY = MetaData:Sourcetype In the search app I still see the logs from the specified host as sourcetype:syslog What am I doing wrong? A restart has already been done with | extract reload=true and with service restart in windows. ... View more