Hello, I would like to display some VPN informations in splunk like username, host information, session id. My problem is that I cannot display username and host information in the same table, the user field doesn't exist?? below the search that I did. I search for user with specifique application use and I try to catch the username, session_id and client_info_host but I get nothing           index="index_X" partition="/Common/XXXXXXXXXXXX:Common" | stats count by user session_id client_info_host | table session_id user client_info_host             If I remove the field "client_info_host" I get the result below.            index="index_X" partition="/Common/XXXXXXXXX:Common" | stats count by user session_id | table session_id user client_info_host             If I filter only with the field "client_info_host" I don't get the value username on the filed with this event.   But for all events the commune value is the session_id, How can I collerate all fields from session_id ?   Regards,   ... View more

Hello, I use cp_log_export on my checkpoint management server to send logs (CEF format) to my syslog-ng server and on the same server, my splunk forwarder send log to my splunk server. I got too many logs from checkpoint and I would like to know if I can did some filters on splunk forwarder or syslog-ng server before ?  for the moment in my syslog-ng I filter uniquely with tho IP source of my checkpoint management server and in my splunk forwarder with the sourcetype (checkpoint:cef).     After regarding the logs on splunk, I would like to get only the logs from the cef_product MTA, can I filter that on splunk forwarder or syslog-ng ? I prefer filtered syslog-ng to reduce the amount of logs in my syslog server.     Regards,     ... View more