I am able to sync my data from the Cisco managed S3 bucket to a local folder on my heavy forwarder. The files are comma delimited with double quotes. With a comma and empty double quotes to show the end of the line (maybe)?
Example:
"date time stamp","user","internal ip address",""
So how do I create the custom event types to get the source and destination IP Addresses.
