harv-qq

Forcepoint matching is inop since upgrade from 2.9.2 > 2.26.5

6

Seems to always go into nix_os index since upgrade from 2.9.2 > 2.26.5 Original config: splunk_metadata.csv forcepoint_webprotect,index,forcepoint forcepoint_webaccess,index,forcepoint forcepoint_webaccess,sourcetype,websense:access forcepoint_weberror,index,forcepoint forcepoint_weberror,sourcetype,websense:error vendor_product_by_source.csv f_forcepoint_web_access,sc4s_vendor_product,"forcepoint_webaccess" f_forcepoint_web_error,sc4s_vendor_product,"forcepoint_weberror" vendor_product_by_source.conf filter f_forcepoint_web_access{ match("wcgextended") }; filter...

What log format is Expected by the forcepoint_webprotect key?

5

Ours isnt being recognised using the out of the box send it to splunk by the Forcepoint Content Gateways (configured via the FSM) % % vendor=Forcepoint product=Security product_version=% action=% severity=%...

Cisco FTD not parsing and TA Doc Issues

2

 states ASA TA will sort FTD as well  states FTD will assign a sourcetype of cisco:ftd The Cisco ASA TA has no reference for any sourcetype apart from...

 the archived app https://splunkbase.splunk.com/app/1629/ only contains props for a source of [source::eStreamer] so this will not do anything for data ingested. It is also archived. Should this be updated...