Getting Data In

Juniper SA (ive)

fisk12
Path Finder

Is anyone having splunk monitoring their juniper secure access machines? And if so, can can you tell me some about how you have done it?

Tags (1)

jaoui
Path Finder

Hey, I started working through this one and so far I have this for one of my searches:

("Login succeeded" OR "Logout from" OR "Session timed out" OR "Max session timeout" OR "Remote address for user") | rex field=_raw "[(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})]\s+(?\w+)((?[^)]+))[(?[^]]*)" | rex field=_raw "(session:(?[^)]+))" | transaction user src keepevicted=true startswith="Login succeeded" endswith=("Session timed out" OR "Logout from" OR "Max session timeout" OR "Remote address for user") | search NOT ("Logout from" OR "Session timed out" OR "Max session timeout" OR "Remote address for user") | eval user = lower(user) | table _time user realm src sessionid host | sort user

this is starting to give me a printout of the currently logged in users. I have to tweak it a bit cuz i think it's not catching some logout/login conditions but here it is if it helps anyone else

0 Karma

jaoui
Path Finder

have you had any luck? I'm just starting to try to pull information out of our IVE's logs

0 Karma
Get Updates on the Splunk Community!

Is there an add-on for the Cisco Meraki devices?

We have many Cisco Meraki devices sending data via syslog to Splunk. Is there an add-on for ...

Should our Deployment Servers have the Search Head server role on them?

all of our stuff is on premcurrently our dedicated Deployment Servers also have the Search Head role on them, ...

Why am I unable to create dropdown static option that is "All" static options ...

Hi, I am trying to get a static option that is "All" the individual static options combined.  The mCode ...