I'm having trouble with this update. The last version worked great, but since I got the update, I've not been able to get it to work. I've made sure to download the new TA and I've recreated my data input for the syslog. I think that might be where my issue is though, I might not be doing that correct.
I'm setting source type to be syslong and I'm leaving index as default. I'm getting an error that states
"received event for unconfigured/disabled index='firewall' with source='source::udp::514' host='host::x.x.x.x'sourcetype='sourcetype::cisco_asa'
Any clue what I'm doing wrong?
Somewhere you have specified in to put stuff in the firewall index. Comment out the forcing of the index in props/transforms if you want stuff to go to main.
Hi, I have the problem too. "received event for unconfigured/disabled index='firewall' with source='source::udp::514' host='host::x.x.x.x'sourcetype='sourcetype::cisco_asa'