Splunk Enterprise

How to set email domain as a field to get statistics on the alias

jjerman
New Member

I'm trying to setup a report/search so that I can get statistics on VPN users. We have a WatchGuard firewall.

We're using the free version of Splunk currently, so we cannot add the WatchGuard app.

Below are a sample of the log files. How can I setup a report or dashboard that will pull the domain (@Firebox-DB) as the field and the alias (the part before the @) as the field data?

SSL VPN user xyz@Firebox-DB
** user[xyz@Firebox-DB]
rcv rqst [TOsteen@Firebox-DB

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You should be able to install the WatchGuard app on the free version of Splunk. What happens when you try?

If it still doesn't work, you'll have to parse the events yourself. One way is with rex.

... | rex "(?<alias>\w+)@(?<domain>.*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You should be able to install the WatchGuard app on the free version of Splunk. What happens when you try?

If it still doesn't work, you'll have to parse the events yourself. One way is with rex.

... | rex "(?<alias>\w+)@(?<domain>.*)" | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

jjerman
New Member

Thanks for the rex command! When I manually add the WatchGuard app it shows up in the Dashboard, but when I open it, "the requested page could not be found".

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!