topic Fortinet filed extractions in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Fortinet-filed-extractions/m-p/566264#M100671 <P>Hi everyone,</P><P>I'm getting probably an issue with the extraction of my Fortinet data. I have installed the following apps:</P><P>&nbsp;</P><TABLE width="537px"><TBODY><TR><TD width="268px">Fortinet FortiGate App for Splunk</TD><TD width="222px">SplunkAppForFortinet</TD><TD width="47px"><P>1.5.1</P></TD></TR><TR><TD width="268px">Fortinet Fortigate Add-on for Splunk</TD><TD width="222px">Splunk_TA_fortinet_fortigate</TD><TD width="47px">1.6.2</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Does anyone know the different of the field <STRONG>action</STRONG> and <STRONG>ftnt_action</STRONG>? because I'm getting different results there.&nbsp;</P><P>In field action do I have for example "<STRONG>blocked</STRONG>" but in <STRONG>ftnt_action</STRONG> do I have "detected" and also "<STRONG>dropped</STRONG>". This is a bit confusing while I'm trying to get only blocked attacks.&nbsp;</P><P>Could someone please help me?</P> Wed, 08 Sep 2021 09:06:37 GMT g_paternicola 2021-09-08T09:06:37Z Fortinet filed extractions https://community.splunk.com/t5/Getting-Data-In/Fortinet-filed-extractions/m-p/566264#M100671 <P>Hi everyone,</P><P>I'm getting probably an issue with the extraction of my Fortinet data. I have installed the following apps:</P><P>&nbsp;</P><TABLE width="537px"><TBODY><TR><TD width="268px">Fortinet FortiGate App for Splunk</TD><TD width="222px">SplunkAppForFortinet</TD><TD width="47px"><P>1.5.1</P></TD></TR><TR><TD width="268px">Fortinet Fortigate Add-on for Splunk</TD><TD width="222px">Splunk_TA_fortinet_fortigate</TD><TD width="47px">1.6.2</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Does anyone know the different of the field <STRONG>action</STRONG> and <STRONG>ftnt_action</STRONG>? because I'm getting different results there.&nbsp;</P><P>In field action do I have for example "<STRONG>blocked</STRONG>" but in <STRONG>ftnt_action</STRONG> do I have "detected" and also "<STRONG>dropped</STRONG>". This is a bit confusing while I'm trying to get only blocked attacks.&nbsp;</P><P>Could someone please help me?</P> Wed, 08 Sep 2021 09:06:37 GMT https://community.splunk.com/t5/Getting-Data-In/Fortinet-filed-extractions/m-p/566264#M100671 g_paternicola 2021-09-08T09:06:37Z