Splunk Enterprise

How to set email domain as a field to get statistics on the alias

jjerman
New Member

I'm trying to setup a report/search so that I can get statistics on VPN users. We have a WatchGuard firewall.

We're using the free version of Splunk currently, so we cannot add the WatchGuard app.

Below are a sample of the log files. How can I setup a report or dashboard that will pull the domain (@Firebox-DB) as the field and the alias (the part before the @) as the field data?

SSL VPN user xyz@Firebox-DB
** user[xyz@Firebox-DB]
rcv rqst [TOsteen@Firebox-DB

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You should be able to install the WatchGuard app on the free version of Splunk. What happens when you try?

If it still doesn't work, you'll have to parse the events yourself. One way is with rex.

... | rex "(?<alias>\w+)@(?<domain>.*)" | ...
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You should be able to install the WatchGuard app on the free version of Splunk. What happens when you try?

If it still doesn't work, you'll have to parse the events yourself. One way is with rex.

... | rex "(?<alias>\w+)@(?<domain>.*)" | ...
---
If this reply helps you, Karma would be appreciated.

jjerman
New Member

Thanks for the rex command! When I manually add the WatchGuard app it shows up in the Dashboard, but when I open it, "the requested page could not be found".

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...