Splunk Add-on for Symantec Blue Coat ProxySG and ASG

Configure inputs for the Splunk Add-on for Symantec Blue Coat ProxySG

On the node responsible for your data collection, configure the input type that matches your configurations in your Blue Coat ProxySG SGOS administration console.

Configure a file monitor input

1. Open or create $SPLUNK_HOME/etc/apps/Splunk_TA_bluecoat-proxysg/local/inputs.conf.
2. Copy and paste the following stanza into the file:

   [monitor://<log path>]
   source = file.bluecoat
   sourcetype = bluecoat:proxysg:access:file
   disabled = false
   

3. Replace <log path> with the log path, file name, and extension that you configured when you set up your Log Facility in SGOS to send logs over FTP.
4. Save the file.
5. If you are using forwarders, configure forwarding by defining tcp outputs and then enabling a receiver.
6. Restart the Splunk platform. If you have a distributed deployment, restart your forwarders and indexers.

Configure a syslog input

1. Open or create $SPLUNK_HOME/etc/apps/Splunk_TA_bluecoat-proxysg/local/inputs.conf.
2. If you are using TCP, copy and paste the following stanza into the file:

   [tcp://514]
   source = tcp.bluecoat
   sourcetype = bluecoat:proxysg:access:syslog
   disabled = false

3. If you are using UDP, copy and paste the following stanza into the file.

   [udp://514]
   source = udp.bluecoat
   sourcetype = bluecoat:proxysg:access:syslog
   disabled = false

4. If you configured a port number other than 514 when set up your Log Facility in SGOS to push logs continuously over syslog, change the port number in the stanza heading to match.
5. Save the file.
   1. If you are using forwarders, configure forwarding by defining tcp outputs and then enabling a receiver.
6. Restart the Splunk platform. If you have a distributed deployment, restart your forwarder and indexers.

Verify your input is working

If you have a distributed deployment, go to your search head. Perform the following search to check that the Splunk platform is indexing events from your Blue Coat ProxySG logs:

sourcetype=bluecoat:proxysg:access*