Getting in the commands from cisco devices

Getting Data In

Hi, I collected the cisco deviceslog with "Cisco Networks Add-on for Splunk Enterprise". And install "Cisco Networks App for Splunk Enterprise" on my search heads. Now I want to know which user at what time execute what commands.

In the App, Audit, "Configuration change transactions" shows me the time and user but for the "cmd" (command) just shows "!exec: enable" .

It just shows the main command that enables user to enter other commands. Is it something wrong with my configs in Splunk or it's just about log level on Cisco devices?

Tanks in advance

Get Updates on the Splunk Community!

Getting in the commands from cisco devices

data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Reuse: Word-play

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

Getting in the commands from cisco devices

data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

[Puzzles] Solve, Learn, Reuse: Word-play

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

Best Practices: Splunk auto adjust pipeline queue