topic cisco_ironport_web.log sample data needed in Splunk Dev

cisco_ironport_web.log sample data needed

pbugeja — Tue, 14 Mar 2017 21:22:44 GMT

I am building an index and would like to get some sample data, specifically Cisco Ironport Web data that contains a user, URL and domain fields.

Re: cisco_ironport_web.log sample data needed

asimagu — Wed, 15 Mar 2017 12:32:55 GMT

you could try this: http://ossec-docs.readthedocs.io/en/latest/log_samples/

Re: cisco_ironport_web.log sample data needed

pbugeja — Wed, 15 Mar 2017 12:41:21 GMT

Hi Asimagu,

I appreciate your reply, but I had reviewed the logs on the OSSEC site and was not able to find the appropriate log that contained the fields needed.
/Paul

Re: cisco_ironport_web.log sample data needed

mattymo — Thu, 16 Mar 2017 02:31:35 GMT

Hi pbugeja!

PRO TIP! : Splunk built TAs usually contain a sample directory! Gives you an idea what we used to build the TAs!

Check out the Cisco WSA TA, it has a few goodies in there! Hopefully one fits your needs!

https://splunkbase.splunk.com/app/1747/