All Apps and Add-ons

Splunk Add-on for Cisco WSA: How to automate username formatting in Top Users panel?

New Member

I am having some trouble with the Cisco Security Suite addon for WSA. The "Top Users" panel I had to modify quite a bit to just get results in it. When I click on a user result it tries to search for NCMH\test.proxy@NCMH which fails to return results. If I change the username format to test.proxy I get results properly. How can I programatically automate this?

My current Top Users search string is as follows: eventtype=cisco-wsa-squid | eval action=if(http_result="TCP_DENIED/","block",action) | eval cs_username=if(isnull(cs_username) OR cs_username="-","["+c_ip+"]",cs_username) | chart count by cs_username,action | eval count=NULL+error | eval f_username=if(match(cs_username,"^["),"",cs_username) | eval f_ip=if(match(cs_username,"^["),replace(cs_username,"[[]]",""),"*") | sort - count | table cs_username,f_username,f_ip,count,NULL,error | rename cs_username as "Username",count as "# Requests", error as "Blocked", NULL as "Allowed"

Thanks in advance for any help as I am a Splunk noob.

P.S. Shame on Cisco for not having better walkthroughs i'm sure i'm not alone when it comes to the default settings not working out of the box.

0 Karma

Splunk Employee
Splunk Employee

I'll take a stab in the dark to get this out of my filters... and guess that because this is W3C web logs which allow almost entirely freeform craziness, and we can only accept a couple of those formats, you've probably got your data coming in one that we don't do.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...