Hi, Please find below, So, you are using [syslog] in outputs.conf on your indexers to send the data to Qradar? Is the other data you are sending to Qradar also being sent from the indexers, rather than the source? If so I guess this rules out connectivity issue. : yes using syslog, [syslog:xx_syslog] server = 1.x.1.2:514 type = udp priority = <13> timestampformat = %b %e %T Lastly, how have you configured the other data sources to send from the indexers to Qradar? Please share config examples of how you've achieved this so we can see if there is an issue here. Props.conf for cisco logs [cisco:ios] TRANSFORMS-soc_syslog_out = send_to_soc Tranforms.conf [send_to_soc] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = soc_syslog
... View more