Highlighted
david.parker2 Absent Member.
Absent Member.
219 views

Importing into ArcSight Logger From ESM

Jump to solution

Greetings,

I am attempting to import from the ESM to the Logger as mentioned above. When I export from the ESM it turns the file into a .arb file. Unfortunately for me, the Logger only accepts .xml.gz files.

What I did before posting to troubleshoot:

1. Changed the file extension in the ESM before saving.

2. Change the file extension after saving.

3. Converted the file to a .zip file.

Any assistance would be greatly appreciated.

Labels (2)
0 Likes
1 Solution

Accepted Solutions
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: Importing into ArcSight Logger From ESM

Jump to solution

What are you trying to do? Are you wanting to share content from ESM into Logger? If so, I am afraid that this won't work. ESM stores its content in one format while Logger uses a different set.

If you want to get data out of ESM and into Logger, you would look at exporting the events from ESM (use an active channel) and save the file as CEF format. You can then use a simple file receiver to pull that data in manually, but you might want to use the Forwarding Connector from ESM to forward directly into Logger directly since it will do it automatically and in real-time.

View solution in original post

0 Likes
2 Replies
pbrettle Acclaimed Contributor.
Acclaimed Contributor.

Re: Importing into ArcSight Logger From ESM

Jump to solution

What are you trying to do? Are you wanting to share content from ESM into Logger? If so, I am afraid that this won't work. ESM stores its content in one format while Logger uses a different set.

If you want to get data out of ESM and into Logger, you would look at exporting the events from ESM (use an active channel) and save the file as CEF format. You can then use a simple file receiver to pull that data in manually, but you might want to use the Forwarding Connector from ESM to forward directly into Logger directly since it will do it automatically and in real-time.

View solution in original post

0 Likes
david.parker2 Absent Member.
Absent Member.

Re: Importing into ArcSight Logger From ESM

Jump to solution

Thanks

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.