Freshly install of TA on SearchHead, Indexer, Intermediate HeavyForwarder and HeavyForwarder that directly receive syslog messages from pfsense firewall.
inputs.conf is
[udp://1234]
connection_host = ip
disabled = 0
index = test
no_appending_timestamp = true
sourcetype = pfsense
Freshly install of TA on SearchHead, Indexer, Intermediate HeavyForwarder and HeavyForwarder that directly receive syslog messages from pfsense firewall.
inputs.conf is [udp://1234] connection_host = ip disabled = 0 index = test no_appending_timestamp = true sourcetype = pfsense
Any suggestion or ideas?