Is there any search or shortcut to list out all the VPN usecases in my environment?

[AL3Z]

Hi, 
Is there any specific fields in the vpn logs we can exclude, which are not needed for investigation so that we can save the license cost ??

[AL3Z]

Is there any search or shortcut to list out all the VPN usecases in my environment.

[richgalloway]

Not really.  You can get a list of use cases with these two queries, but you'll have to add your own filters based on your knowledge of the data.  For instance, some VPN use cases may not contain the string "vpn".

| rest /servicesNS/-/-/saved/searches

| rest /servicesNS/-/-/data/ui/views

[AL3Z]

@richgalloway 

As I'm trying  to exclude the fields like user_watchlist & ip_options under the vpn index etc.
Can you pls share the props and transforms  .conf to exclude the above fields by creating a  custom app.

Thanks

[richgalloway]

Consider using SEDCMD in props.conf to remove the unwanted fields, assuming the fields can be described using a regular expression.  For simplicity, use a separate SEDCMD for each field.

For example, assuming the data looked like "...user_watchlist=foo, ip_options=bar, ..."

SEDCMD-no-user_watchlist = s/user_watchlist=[^,],+//
SEDCMD-no-ip_options = s/ip_options=[^,]+,//

[richgalloway]

That's a question only you and your coworkers can answer.  Review your VPN use cases and the fields they use.  Anything else, in theory, can be eliminated.  Of course, future use cases may need an eliminated field so be prepared to add them back some day.