Re: Search help - Splunk Community

Splunk Search

I have the Sophos XG forwarding logs to Splunk. How do i search for users who logged into Sophos XG in Splunk.

Hello @ticbos

if you are receiving audit logs of Sophos, then you can easily search it.

There are several apps for Sophos in Splunkbase. Have you tried any of them?

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Defend at Machine Speed: Your Guide to Security Sessions at .conf26

Splunk .conf26 With threats moving at machine speed and attack surfaces expanding across hybrid ...

Where Innovation Takes Flight: The Splunk4Aviation Flight Sim Lands at .conf26

If you hear someone at .conf26 shouting "gear down, GEAR DOWN" across the show floor, you have found us. The ...

Turn Cisco Telemetry Into Action with Cisco Data Fabric, powered by the Splunk ...

The surge in machine data is already hitting enterprise budgets, and the agentic era will only intensify it. ...