Hi All,
I'm testing out sophos logging into Splunk, and have just noticed that splunk is getting a bit confused about the src_mac field.
The logs XG is generating contain the src_mac field unquoted, which would be fine except that an unknown mac address looks like 00: 0:00: 0:00: 0, with 3 field delimiters (spaces) in it.
Is this a known bug?
James
This thread was automatically locked due to age.
