Troubleshoot the Splunk Add-on for Symantec Blue Coat ProxySG
Finding legacy data
If you had a previous version of the Splunk Add-on for Symantec Blue Coat ProxySG installed, your legacy events are indexed using
sourcetype=bluecoat. This version of the add-on renames that sourcetype. You can find all new events using
Slow search performance
If you are using only one specific version of Blue Coat logs, you can comment out the
Report-auto_kv lines for the unused versions in
default/props.conf to improve search performance.
Fields are not extracted correctly using syslog
Check that you are using the correct sourcetype in your input configuration. For UDP or TCP inputs, the correct sourcetype is
If you are using a UDP or TCP input with the correct sourcetype and the field extractions are not working, your field names or field order may have been customized in Blue Coat ProxySG. Check the fields:
- Identify the
auto_kv_for_bluecoatstanza that matches your version of Blue Coat ProxySG.
- Compare the field names in the FORMAT line against the file header in your logs.
- If they do not match, make a local copy of this
- In the local copy, adjust the FORMAT line to match your logs and make any corresponding changes necessary to the regular expression.
Fields are not extracted correctly using file monitoring
Check that you are using the correct sourcetype in your input configuration. For a file monitoring input, the sourcetype should be
If you are using a file monitoring input with the correct sourcetype and the field extractions are not working, check to make sure the file header in your log file is correct for file content. The Splunk platform extracts all fields based on the headers at the beginning of each file. If your field definitions change mid-file, the Splunk platform cannot detect the shift.
Configure inputs for the Splunk Add-on for Symantec Blue Coat ProxySG
Lookups for the Splunk Add-on for Symantec Blue Coat ProxySG
This documentation applies to the following versions of Splunk® Supported Add-ons: released