Hi @ayushmaan, To have the user that used the CLI command, you have to take the Linux logs of history. If you see in the Splunk_TA_nix App there's in input.conf the configuration to take these logs and to see the user that executed: ### bash history [monitor:///root/.bash_history] disabled = 0 sourcetype = bash_history index = os [monitor:///home/.../.bash_history] disabled = 0 sourcetype = bash_history index = os The folder before .bash_history is the username of the user that launched the CLI command. Ciao. Giuseppe ... View more

Try again. Post sample events and a mockup of your desired output. There is no possible way that we can help you with how little you have given us. ... View more

you can check cert validity and details using openssl: openssl x509 -enddate -noout -in your_cert.pem or echo | openssl s_client -showcerts -connect your_splunk_server:port ... View more