How to set email domain as a field to get statistics on the alias

[jjerman]

I'm trying to setup a report/search so that I can get statistics on VPN users. We have a WatchGuard firewall.

We're using the free version of Splunk currently, so we cannot add the WatchGuard app.

Below are a sample of the log files. How can I setup a report or dashboard that will pull the domain (@Firebox-DB) as the field and the alias (the part before the @) as the field data?

SSL VPN user xyz@Firebox-DB
** user[xyz@Firebox-DB]
rcv rqst [TOsteen@Firebox-DB

[richgalloway · Accepted solution]

You should be able to install the WatchGuard app on the free version of Splunk. What happens when you try?

If it still doesn't work, you'll have to parse the events yourself. One way is with rex.

... | rex "(?<alias>\w+)@(?<domain>.*)" | ...

[jjerman]

Thanks for the rex command! When I manually add the WatchGuard app it shows up in the Dashboard, but when I open it, "the requested page could not be found".