Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- About buldamoosh
buldamoosh
New Member
Member since:
10-06-2011
06-05-2020
Community Statistics
| Posts | 5 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 10-06-2011 |
Activity Feed
- Posted Re: Why am I not getting the cisco:acs sourcetype after installing Add-on for Cisco ACS 5.x? on All Apps and Add-ons. 07-31-2014 08:51 AM
- Posted Re: Why am I not getting the cisco:acs sourcetype after installing Add-on for Cisco ACS 5.x? on All Apps and Add-ons. 07-31-2014 08:51 AM
- Posted Why am I not getting the cisco:acs sourcetype after installing Add-on for Cisco ACS 5.x? on All Apps and Add-ons. 07-30-2014 01:26 PM
- Tagged Why am I not getting the cisco:acs sourcetype after installing Add-on for Cisco ACS 5.x? on All Apps and Add-ons. 07-30-2014 01:26 PM
- Tagged Why am I not getting the cisco:acs sourcetype after installing Add-on for Cisco ACS 5.x? on All Apps and Add-ons. 07-30-2014 01:26 PM
- Tagged Why am I not getting the cisco:acs sourcetype after installing Add-on for Cisco ACS 5.x? on All Apps and Add-ons. 07-30-2014 01:26 PM
- Posted Re: Return First user and _time from ACS syslog on Splunk Search. 02-28-2012 10:40 AM
- Posted Return First user and _time from ACS syslog on Splunk Search. 02-28-2012 09:49 AM
- Tagged Return First user and _time from ACS syslog on Splunk Search. 02-28-2012 09:49 AM
Topics I've Started
07-31-2014
08:51 AM
I'm assuming I could key on CSCOacs in the syslog messages.
Jul 31 10:25:20 gthou-nsacs01p.energy.sug.pri Jul 31 10:25:12 gthou-nsacs01p CSCOacs_Passed_Authentications 0083647704 11
How would I phrase the Transform and where would I put it?
... View more
07-31-2014
08:51 AM
I'm assuming I could key on CSCOacs in the syslog messages.
Jul 31 10:25:20 gthou-nsacs01p.energy.sug.pri Jul 31 10:25:12 gthou-nsacs01p CSCOacs_Passed_Authentications 0083647704 11
How would I phrase the Transform and where would I put it?
... View more
07-30-2014
01:26 PM
I've installed the add-on for Cisco ACS TA-cisco_acs but I am still not getting the cisco:acs sourcetype. Can anyone help me?
... View more
02-28-2012
10:40 AM
Awesome, that definitely got my results as I expected them. Thank you so much! Can you point me to a document that will help me to export the dataset to a CSV with the User_name and the _time?
... View more
02-28-2012
09:49 AM
Firstly, my data is formatted like this:
Dec 15 13:58:12 gthou-nsacs01p CisACS_01_PassedAuth ne8yfimc 1 0 Message-Type=Authen OK,User-Name=Adorton,NAS-IP-Address=10.71.11.7,Caller-ID=174.253.112.223,NAS-Port=124190720,Group-Name=VPN Neudesic,Filter Information=No Filters activated.,AAA Server=gthou-nsacs01p,Network Device Group=Wireless and VPN,Access Device=phe-ardmore-int-sa00-rad,
I've created an eventtype which keys on "Message-Type=Authen OK" called acs-authentication-success. The query I'm working off of looks like this:
eventtype=acs-authentication-success | uniq User_Name | sort User_Name, -_date | fields User_Name, _time
However, rather than displaying the latest time that every User_Name was seen in the syslog data, it returns EVERY individual instance. I'm new to splunk reporting and would appreciate any assistance. Thanks in advance!
... View more
- Tags:
- unique
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-05-2020
02:03 AM
|
