https://community.splunk.com/t5/Getting-Data-In/Bluecoat-and-websense-Logs/m-p/257094#M96263 <P>what is wrong in below:</P> <P>index=websense sourcetype=websense src NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]</P> Wed, 19 Oct 2016 10:26:41 GMT rashid47010 2016-10-19T10:26:41Z https://community.splunk.com/t5/Getting-Data-In/Bluecoat-and-websense-Logs/m-p/257093#M96262 <P>Hi Everyone,</P> <P>we have bluecoat and websense. we need to detec the user who is browsing some suspecious website. the trail is available in bcoat proxy logs but not in websesne.</P> <P>so how can we findout that user who is browsing directly and there is no browsing logs available on websense for that user.</P> Mon, 17 Oct 2016 09:06:31 GMT https://community.splunk.com/t5/Getting-Data-In/Bluecoat-and-websense-Logs/m-p/257093#M96262 rashid47010 2016-10-17T09:06:31Z https://community.splunk.com/t5/Getting-Data-In/Bluecoat-and-websense-Logs/m-p/257094#M96263 <P>what is wrong in below:</P> <P>index=websense sourcetype=websense src NOT [search index=bcoat sourcetype="bluecoat:proxysg:access:file" | fields src ]</P> Wed, 19 Oct 2016 10:26:41 GMT https://community.splunk.com/t5/Getting-Data-In/Bluecoat-and-websense-Logs/m-p/257094#M96263 rashid47010 2016-10-19T10:26:41Z