https://community.splunk.com/t5/Getting-Data-In/Getting-in-the-commands-from-cisco-devices/m-p/625207#M107459 <P>Hi, I collected the cisco deviceslog with "Cisco Networks Add-on for Splunk Enterprise". And install&nbsp; "Cisco Networks App for Splunk Enterprise" on my search heads. Now I want to know which user at what time execute what commands.</P><P>In the App, Audit,&nbsp; "Configuration change transactions"&nbsp; shows me the time and user but for the "cmd" (command) just shows "!exec: enable" .</P><P>It just shows the main command that enables user to enter other commands. Is it something wrong with my configs in Splunk or it's just about log level on Cisco devices?</P><P>Tanks in advance</P> Sat, 24 Dec 2022 08:44:35 GMT m_zandinia 2022-12-24T08:44:35Z https://community.splunk.com/t5/Getting-Data-In/Getting-in-the-commands-from-cisco-devices/m-p/625207#M107459 <P>Hi, I collected the cisco deviceslog with "Cisco Networks Add-on for Splunk Enterprise". And install&nbsp; "Cisco Networks App for Splunk Enterprise" on my search heads. Now I want to know which user at what time execute what commands.</P><P>In the App, Audit,&nbsp; "Configuration change transactions"&nbsp; shows me the time and user but for the "cmd" (command) just shows "!exec: enable" .</P><P>It just shows the main command that enables user to enter other commands. Is it something wrong with my configs in Splunk or it's just about log level on Cisco devices?</P><P>Tanks in advance</P> Sat, 24 Dec 2022 08:44:35 GMT https://community.splunk.com/t5/Getting-Data-In/Getting-in-the-commands-from-cisco-devices/m-p/625207#M107459 m_zandinia 2022-12-24T08:44:35Z