All Apps and Add-ons

Collecting Data from McAfee Web Gateway: 7.3.2.8.0

wdeoliveira_spl
Splunk Employee
Splunk Employee

Hello all,

Any experiences around collecting data from McAfee Web Gateway: 7.3.2.8.0 ?

WHich inputs.conf configuration should I use?

Any specific source Type?

Thanks-

Wellington

0 Karma

sbattista09
Contributor

i added two files to /opt/splunk/etc/apps/AppForMcAfeeWebGateway/local/ and then added an inputs.conf and indexes.conf file and my stuff started to work. hope this helps.

0 Karma

PavelP
Motivator

Hello,

you can get the logs via syslog, using the splunk forwarder oder reading local files - it depends on your setup.

In any case you have to define the sourcetype manually, see the step #4 of the install instruction:
From the App, go to Settings > Data inputs and configure Log Input; click "More settings", select drop down "Set the source type" to "Manual" and type in "MWGaccess3". (see one of the screenshots).

best regards
Pavel

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...