https://community.splunk.com/t5/Getting-Data-In/Juniper-SA-ive/m-p/27206#M4536 <P>have you had any luck? I'm just starting to try to pull information out of our IVE's logs</P> Mon, 17 Oct 2011 22:43:43 GMT jaoui 2011-10-17T22:43:43Z https://community.splunk.com/t5/Getting-Data-In/Juniper-SA-ive/m-p/27205#M4535 <P>Is anyone having splunk monitoring their juniper secure access machines? And if so, can can you tell me some about how you have done it?</P> Sun, 16 Jan 2011 21:28:48 GMT https://community.splunk.com/t5/Getting-Data-In/Juniper-SA-ive/m-p/27205#M4535 fisk12 2011-01-16T21:28:48Z https://community.splunk.com/t5/Getting-Data-In/Juniper-SA-ive/m-p/27206#M4536 <P>have you had any luck? I'm just starting to try to pull information out of our IVE's logs</P> Mon, 17 Oct 2011 22:43:43 GMT https://community.splunk.com/t5/Getting-Data-In/Juniper-SA-ive/m-p/27206#M4536 jaoui 2011-10-17T22:43:43Z https://community.splunk.com/t5/Getting-Data-In/Juniper-SA-ive/m-p/27207#M4537 <P>Hey, I started working through this one and so far I have this for one of my searches:</P> <P><INSERT realm=""> ("Login succeeded" OR "Logout from" OR "Session timed out" OR "Max session timeout" OR "Remote address for user") | rex field=_raw "[(?<SRC>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})]\s+(?<USER>\w+)((?<REALM>[^)]+))[(?<ROLE>[^]]*)" | rex field=_raw "(session:(?<SESSIONID>[^)]+))" | transaction user src keepevicted=true startswith="Login succeeded" endswith=("Session timed out" OR "Logout from" OR "Max session timeout" OR "Remote address for user") | search NOT ("Logout from" OR "Session timed out" OR "Max session timeout" OR "Remote address for user") | eval user = lower(user) | table _time user realm src sessionid host | sort user</SESSIONID></ROLE></REALM></USER></SRC></INSERT></P> <P>this is starting to give me a printout of the currently logged in users. I have to tweak it a bit cuz i think it's not catching some logout/login conditions but here it is if it helps anyone else</P> Mon, 28 Sep 2020 09:59:46 GMT https://community.splunk.com/t5/Getting-Data-In/Juniper-SA-ive/m-p/27207#M4537 jaoui 2020-09-28T09:59:46Z