Yes, it has to do with a bad log format in Squid 😠 and no one updated the docs. I solved via Squid docs and process of elimination. I can't seem to get the ssl::sni to work at all but this is all of the options without ssl::sni.  logformat splunk_recommended_squid %ts.%03tu logformat=splunk_recommended_squid duration=%tr src_ip=%>a src_port=%>p dest_ip=%<a dest_port=%<p user_ident="%ui" user="%un" local_time=[%tl] http_method=%rm request_method_from_client=%<rm request_method_to_server=%>rm url="%ru" http_referrer="%{Referer}>h" http_user_agent="%{User-Agent}>h" status=%>Hs vendor_action=%Ss dest_status=%Sh total_time_milliseconds=%<tt http_content_type="%mt" bytes=%st bytes_in=%>st bytes_out=%<st ... View more

The issue is related to the following python file packaged with AOB. On older versions of AOB packages the credential.py is looking for 8 asterisks in inputs.conf. In later versions it's looking for 6  asterisks, and as a result they overwrite values in password.conf. Basically, your password.conf file will have  8 asterisks encrypted in the resulting password.conf file.    /opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # if the field value is '********', keep the original value /opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # original password does not exist, use '********' as password /opt/splunk/etc/apps/TA-proofpoint-/opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # if the field value is '********', keep the original value /opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # original password does not exist, use '********' as password /opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # if the field value is '********', keep the original value /opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # original password does not exist, use '********' as password /opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # if the field value is '********', keep the original value /opt/splunk/etc/apps/TA-proofpoint-isolation/bin/ta_proofpoint_isolation/aob_py3/splunktaucclib/rest_handler/credentials.py: # original password does not exist, use '********' as password     ... View more