Hi there,I'm pretty new to Splunk, but have got a fortigate set up to send all logs to Splunk.Simply looking to find all attacks that Fortigate identifies that are successful. Fortigate is being managed by another team.I've got index = "*" AND tag = "attack" AND action = "allowed", but that seems to be way too simple.Or am I hugely overthinking this?
It's possible you're overthinking it. If simple works then don't question it.
Do not use "index=*". Specify the exact index name where Foiitgate events are stored.
