Getting in the commands from cisco devices

Getting Data In

Hi, I collected the cisco deviceslog with "Cisco Networks Add-on for Splunk Enterprise". And install "Cisco Networks App for Splunk Enterprise" on my search heads. Now I want to know which user at what time execute what commands.

In the App, Audit, "Configuration change transactions" shows me the time and user but for the "cmd" (command) just shows "!exec: enable" .

It just shows the main command that enables user to enter other commands. Is it something wrong with my configs in Splunk or it's just about log level on Cisco devices?

Tanks in advance

Get Updates on the Splunk Community!

Getting in the commands from cisco devices

data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation

Getting in the commands from cisco devices

data

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security