The Symantec WAF App For Splunk provides several dashboards to render data from WAF logs and general ProxySG . The dashboards provide visual charts and graphs to display attack families, malware information, engines (including engine parts and rules) and other blocked or monitored details. Exclusive to this app is the feature to filter dashboards based on the x-bluecoat-transaction-uuid. As long as you have the x-bluecoat-transaction-uuid (provided in the logs), you are able to visualize the data exclusively from that transaction. Technical Add-On required installation here: https://splunkbase.splunk.com/app/3427/