Is there any update on whether or not this is going to be fixed? I'm running into the same issue as the original author right now. ... View more

Actually, I can't : not all logs received on udp:514 are juniper-sa-access. The stanza set_juniper-sa-access contains a regex to check the format. ... View more

@hazekamp, what constitutes a "generating search command"? I'm trying to use the following as a search restriction but it doesn't work: [| username | lookup contacts USERNAME AS current_user OUTPUTNEW EGROUP AS contact | fields contact | format] username is a custom command that just puts the current user's name into current_user, and the rest is just a lookup. This produces something like this: ( ( ( contact="jimbo" OR contact="jones" ) ) ) which works just fine when I type it into a search bar. Is it that I can't use subsearches as a search restriction? ... View more

has anyone been able to get the 2.0 version of SPLUNK OPSEC LEA working with this same Checkpoint architecture ? ... View more