Hello, I need your help please. I have a log like F5:WAF "2020-04-08 15:36:21","146632585856347577","",192.121.195.41,443,190.92.12.16,.... anD i want to extract data after the text "F5:WAF": 1st field: the date "2020-04-08 15:36:21" 2nd field: the source ip "192.121.195.41" 3th field: the port "443" ane the 4th the dest ip "190.92.12.16". Thank you! ... View more

I am new on Splunk. I am using Infosec app and I have question please. I am getting logs from the firewall after executing this command: | datamodel Network_Traffic All_Traffic search But the Network_Traffic data model doesn't show any results after this request: | tstats summariesonly=true allow_old_summaries=true count from datamodel=Network_Traffic.All_Traffic where (All_Traffic.action=blocked OR All_Traffic.action=deny) Any idea how to resolve this?? ... View more