Need a report based on previous day  I have source ip segment xx.xx.xx.xx/28, & destination ip segment xx.xx.xx/24  outcome of query should provide below Date and start + end time of the connection USERNAME APPLICATION:PORT & PROTOCOL APPLICATION SEGMENTS ACCESS POLICY NAME ACTION how can i create customized dashboard, please suggest. ... View more

We have multiple firewalls and different locations and each location we have syslog collector server and its forward the logs to splunk indexer.  Pan: traffic count 27,644,629 83% Pan:threat count 3,224,543 9.77% Pan:firewall_cloud 2,034,183 6.18% last one hour data. it looks like over utilization, so we want to validate receiving logs are legitimate or not?  Planning to reduce consumption of firewall logs.  Please guide me how can i validate firewall logs we are reciving correct logs or any excessive or not needed? ... View more

I have enterprise network and we have Splunk enterprise license.  Question: while troubleshooting source type or host if checking, it needs to show past history of particular user or source in the dashboard. Past history like how many alerts triggered the same user, those alert details if click the link it must be show past troubleshooting history. ... View more