ARe you indexing this data in Splunk? Windows or Linux? Are you using a Splunk app to collect this information?
The community needs the context in order to answer the question. You might also want to look at splunkbase's Apps to see if there is something there that could solve your problem.
