From a979a585367768ee0d5289b88ca7377ddddc679f Mon Sep 17 00:00:00 2001
From: Mark Bonsack <mbonsack@splunk.com>
Date: Sun, 8 Mar 2020 13:28:55 -0700
Subject: [PATCH] Bump Cisco ACS/ISE multi-event timer to 30s

* Increase multi-event timer to 30s to catch more late events and include them in the group
---
 package/etc/conf.d/log_paths/lp-cisco_acs.conf.tmpl | 2 +-
 package/etc/conf.d/log_paths/lp-cisco_ise.conf.tmpl | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/etc/conf.d/log_paths/lp-cisco_acs.conf.tmpl b/package/etc/conf.d/log_paths/lp-cisco_acs.conf.tmpl
index 5288c07..9dbf86f 100644
--- a/package/etc/conf.d/log_paths/lp-cisco_acs.conf.tmpl
+++ b/package/etc/conf.d/log_paths/lp-cisco_acs.conf.tmpl
@@ -33,7 +33,7 @@ parser acs_grouping {
             value("MESSAGE" "$(implode '' $(context-values ${MESSAGE}))")
             value("ACS.COMPLETE" "yes")
         )
-        timeout(10)
+        timeout(30)
     );
 };
 
diff --git a/package/etc/conf.d/log_paths/lp-cisco_ise.conf.tmpl b/package/etc/conf.d/log_paths/lp-cisco_ise.conf.tmpl
index ec5c3c2..de141b7 100644
--- a/package/etc/conf.d/log_paths/lp-cisco_ise.conf.tmpl
+++ b/package/etc/conf.d/log_paths/lp-cisco_ise.conf.tmpl
@@ -33,7 +33,7 @@ parser ise_grouping {
             value("MESSAGE" "$(implode '' $(context-values ${MESSAGE}))")
             value("ISE.COMPLETE" "yes")
         )
-        timeout(10)
+        timeout(30)
     );
 };