About aaronhentschel

aaronhentschel · ‎03-23-2017

Sorry, I just realised that your Settings of the "source User" filter look different to mine. My Token Prefix is: log.user=" and my Token Suffix is " I remove the quotes and it now works.

aaronhentschel · ‎03-23-2017

Thanks adonio. Even I place a * in the Source User field it still returns no results 😞 The other filter fields work fine, it is just the Source User filter.

aaronhentschel · ‎03-23-2017

Thanks Adonio. That has certainly helped, but while that works perfectly for the "Traffic Dashboard", if I try and filter on the "Web Activity Report" it seems the "Source User" filter has no effect while the "Source IP" and "Destination Hostname" filters work fine. It would be great to be able to filter within the "Web Activity Report" by user. Do you see the same issue in your environment?

aaronhentschel · ‎03-23-2017

We are trying to determine the best way to provide a user activity report from our Palo Alto logs and are having trouble with the appropriate Splunk search. Something to show "total bytes for each destination hostname grouped by user over a nominated time period" . Could anyone provide any advice on how that search could be written? Obviously we are rather new to Splunk but have the search basics in hand, just not more advanced search syntax. We are using Splunk 6.5.2, Palo Alto Networks Add-on for Splunk 3.7.1 and Palo Alto Networks App for Splunk 5.3.1.

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-23-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Palo Alto Networks App and Add-on for Splunk: How ...

Re: Palo Alto Networks App and Add-on for Splunk: ...

Re: Palo Alto Networks App and Add-on for Splunk: ...

Re: Palo Alto Networks App and Add-on for Splunk: ...

Palo Alto Networks App and Add-on for Splunk: How ...

Are you a member of the Splunk Community?

Palo Alto Networks App and Add-on for Splunk: How ...

Re: Palo Alto Networks App and Add-on for Splunk: ...

Re: Palo Alto Networks App and Add-on for Splunk: ...

Re: Palo Alto Networks App and Add-on for Splunk: ...

Palo Alto Networks App and Add-on for Splunk: How ...