icon/x Created with Sketch.

Splunk Cookie Policy

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website. Learn more (including how to update your settings) here.
Accept Cookie Policy

We are working on something new...

A Fresh New Splunkbase
We are designing a New Splunkbase to improve search and discoverability of apps. Check out our new and improved features like Categories and Collections. New Splunkbase is currently in preview mode, as it is under active development. We welcome you to navigate New Splunkbase and give us feedback.
Log4Shell Vulnerability: Information and guidance for you. Get resources.

Accept License Agreements

This app is provided by a third party and your right to use the app is in accordance with the license provided by that third-party licensor. Splunk is not responsible for any third-party apps and does not provide any warranty or support. If you have any questions, complaints or claims with respect to this app, please contact the licensor directly.

Thank You

Downloading Splunk for Blue Coat ProxySG
SHA256 checksum (splunk-for-blue-coat-proxysg_307.tgz) 3c1f399403db17136cd97885672dbf5378d1249536df680dce92848ff1dea8a0 SHA256 checksum (splunk-for-blue-coat-proxysg_306.tgz) db4fdf3064cca019aeafe8fecba183e7ccab2970494d4af5a809f02c2b41240d SHA256 checksum (splunk-for-blue-coat-proxysg_305.tgz) a1e9f391abc7638256a989ae36f9e3f46eb3b501d06bb9e47a019a991e9cc6ae SHA256 checksum (splunk-for-blue-coat-proxysg_304.tgz) e81aa862b8c1b811395772143651bda1aad82794948c0d27fe6b1ce54ee89bb1 SHA256 checksum (splunk-for-blue-coat-proxysg_303.tgz) 7134a93b1369532562e3dbdb48b9d65595ab354cb17af3857d1fe701ecb3504f SHA256 checksum (splunk-for-blue-coat-proxysg_302.tgz) f158b767ca3897d57204e02b09505c508e1b477d3deeff9ac4ba95b06120bfbd SHA256 checksum (splunk-for-blue-coat-proxysg_301.tgz) ab41405b995eb91259769bb4c55a0e3eb3ccff8147f068b8bcc796980f4f0e63 SHA256 checksum (splunk-for-blue-coat-proxysg_300.tgz) dd2c2b820b3c57e58915d23b254758b7ca658ad89c3dc4ca662c9f3986ac3694 SHA256 checksum (splunk-for-blue-coat-proxysg_510.tgz) 216acc9c96a528b1708731b30728c95b7cf29c7cf3e356f38196f8c149f68b43 SHA256 checksum (splunk-for-blue-coat-proxysg_501.tgz) 310db9f42c0e400a63ebc4b79ea34655787d17a8b50eda195478ac8c4df89d84 SHA256 checksum (splunk-for-blue-coat-proxysg_500.tgz) c28b4cfadff75fd9314a5fc0f33b547ada3734d470476c5b01c0a5dbc9ee5324 SHA256 checksum (splunk-for-blue-coat-proxysg_12.tgz) 705f86d7990a7adf482ec266d33ad6129630ce9d15324a35d404868c0cea021c SHA256 checksum (splunk-for-blue-coat-proxysg_11.tgz) 705f86d7990a7adf482ec266d33ad6129630ce9d15324a35d404868c0cea021c SHA256 checksum (splunk-for-blue-coat-proxysg_10.tgz) bdf6e635e4607ae9276ea47339aacdf6010940c70f16797b01112c13132c6f8f SHA256 checksum (splunk-for-blue-coat-proxysg_beta-4.tgz) 8707e2795574b6940dbd1afa203da68fa76ac7d1eaee12608470d5ff8954f4b8 SHA256 checksum (splunk-for-blue-coat-proxysg_beta12.tgz) 0856ca361a103cf76a0a9e6587cde32e9649060f2e52da1c8b516fa7aa2c11a9 SHA256 checksum (splunk-for-blue-coat-proxysg_beta2.tgz) ca630a9ca2153c4d64f5bdc85bfcc24ca88cccd95c4733859dafa5b0f69ef7ef SHA256 checksum (splunk-for-blue-coat-proxysg_beta11.tgz) ca630a9ca2153c4d64f5bdc85bfcc24ca88cccd95c4733859dafa5b0f69ef7ef SHA256 checksum (splunk-for-blue-coat-proxysg_beta1.tgz) d1bff4e06d88e1602761bb8fc7cdde973af971c085db23f23330d41e99ae2fa9 SHA256 checksum (splunk-for-blue-coat-proxysg_091.tgz) db593931df2acc5b1f92d3e98f38968ae2b7b30b8c67fdb4a5c4e358e731b43c SHA256 checksum (splunk-for-blue-coat-proxysg_09.tgz) fdeebbe25288e35e41e2c6ea055eaa10b2030fd88ab882ec019f7f27c6cd3a65
To install your download
For instructions specific to your download, click the Details tab after closing this window.

Flag As Inappropriate


Splunk for Blue Coat ProxySG

This app has been archived. Learn more about app archiving.
This app is NOT supported by Splunk. Please read about what that means for you here.
App for Blue Coat ProxySG


For setup help or any questions, please post them on answers.splunk.com and tag them with SplunkAppForBlueCoatProxySG.


  • Real-time dashboards, panels, and search fields to easily view and investigate Blue Coat data
  • Contains latest performance and scalability improvements
  • Correlate Blue Coat data with other data sources in Splunk Enterprise to detect and remediate additional advanced threats


The app requires the Google Maps (http://splunk-base.splunk.com/apps/22365/google-maps) app from Splunkbase. You do not need to install this apps if you do not wish to use the mapping features. However, the main dashboard will not render properly without the above apps.


If you want to use the map feature, install the app dependencies from Splunkbase. If you are running a distributed splunk setup, the app contains an Add-on that you can install on the indexers. Otherwise, you just need to install the app from splunk base.

Getting data in

In Splunk, you will need to add a new TCP Data input. The app expects the source type to be bcoat_log. You may choose something different, but you will need to modify the app as well. Too add this input, log into Splunk and click on Manager. Under the Data section, click on "Data inputs". Then click on "Add new" for a TCP input. On this page, you can enter the port number, 20108 for example. You can optionally override the source name as well. Leave "Set sourcetype" as "From list", and choose bcoat_log from the dropdown list. Click on more settings, and set the index for this source to be bcoat_logs.

In Blue Coat, you will have to set up custom client for the logs you want to forward to Splunk. You will need to give it the Splunk indexer IP address and the TCP port you specified earlier.

If you are using a different index, in addition to modifying the bcoat_request macro, you will need to modify the bcoat_overview dashboard. To do this:

  • From the Splunk for Bluecoat app, click on Manager on the top right portion of the screen
  • Click User Interface
  • Click Views
  • Click bcoat_overview
  • In the text-editor, search for index=bcoat_index and replace it with the correct index
  • Click Save
  • Navigate back to the app, and the splash page should now work.

Configuring the app

You may have to modify the incoming sourcetype, transforms.conf, and props.conf depending on your BlueCoat configuration. By default, the app expects the incoming logs to be in the bcreportermain_v1 format for ProxySG 6.2.x and above. Specifically, it expects these fields:

date, time, time_taken, c_ip, cs_username, cs_auth_group,
x_exception_id, filter_result, category,http_referrer,
sc_status, action, cs_method, http_content_type, cs_uri_scheme,
cs_host, cs_uri_port, cs_uri_path, cs_uri_query,
cs_uri_extension, http_user_agent, s_ip, sc_bytes, cs_bytes,
x_virus_id, x_bluecoat_application_name, x_bluecoat_application_operation

If you are running an earlier version of SGOS, you can create an entry in the bcoat_proxysg section of your local props.conf file to use the brceportermain_v1_old format. It's the same format but without x_bluecoat_application_name and x_bluecoat_application_operation.

If you use a different log format than those, you will need to create an entry for it in your local transforms.conf file. Then in the bcoat_proxysg section of your local props.conf, you will need to set REPORT-main to the name you specified in the transforms.conf. You may need to set appropriate field aliases as well.

Modifying the macros

The app uses macros to define the categories for WFA issues and possible infections. Depending on your policies, you may want to modify these macros to suite your needs. These are located in the macros.conf file.

Release Notes

Version 3.0.7
Aug. 4, 2013

Updated support information.

Version 3.0.6
June 1, 2013

Moved nullPound transform to bcoat_logs in props.conf. This will make it easier to monitor log file on disk because it will ignore the header lines (lines that begin with #).

Version 3.0.5
May 23, 2013

Fixed issue with data not display in app. Blue Coat always uses UTC timestamps, so configured app to reflect that reality.
Updated About App page.

Version 3.0.4
May 17, 2013

Fixed issue where bluecoat field s_ip was mislabed as dest_ip instead of dvc_ip. Fixed issue preventing the Dashboard Map from populating.

Version 3.0.3
May 9, 2013

Small vocab changes

Version 3.0.2
May 1, 2013

Corrected the name of the log format in the README.

Version 3.0.1
April 16, 2013

Fixed location MAX_TIMESTAMP_LOOKAHEAD in props.conf

Version 3.0.0
April 11, 2013

Latest version has improved performance and scalability.

Version 5.1.0
Jan. 1, 2013

Fixes large text in single value displayed
Updated logic on determining if a site was blocked or not to use filter_result

Version 5.0.1
Nov. 9, 2012

Updated version of Blue Coat app

Version 5.0.0
Nov. 9, 2012

Major update to app

Version 1.2
March 11, 2010
Version 1.1
Jan. 7, 2010
Version 1.0
Dec. 9, 2009
Version Beta 4
Oct. 26, 2009
Version Beta1.2
July 21, 2009
Version Beta2
July 21, 2009
Version Beta1.1
July 21, 2009
Version Beta1
July 19, 2009
Version 0.91
July 14, 2009
Version 0.9
July 13, 2009

Subscribe Share

Are you a developer?

As a Splunkbase app developer, you will have access to all Splunk development resources and receive a 10GB license to build an app that will help solve use cases for customers all over the world. Splunkbase has 1000+ apps from Splunk, our partners and our community. Find an app for most any data source and user need, or simply create your own with help from our developer portal.

Follow Us:
Splunk, Splunk>,Turn Data Into Doing, Data-to-Everything, and D2E are trademarks or registered trademarks of Splunk Inc. in the United States and other countries. All other brand names,product names,or trademarks belong to their respective owners.