Reporting

How to create a report for VPN user sessions including username, source ip, date and time for sonic wall firewall

RK_sp1unk
New Member

We have a customer who had CISCO firewall but got it replaced by Sonicwall, now the VPN user session reports are not generating correctly.
What needs to be checked? Please share details.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You probably need to change TAs. The Cisco TA probably won't work with Sonicwall data. Try the one at https://splunkbase.splunk.com/app/4507/.

Then, like @woodcock said, you likely need to change the query that produces the report. There looks to be an app for that, too. See https://splunkbase.splunk.com/app/4544/.

---
If this reply helps you, Karma would be appreciated.
0 Karma

RK_sp1unk
New Member

sourcetype="cisco:asa" created OR deleted direction=inbound | rex "(?i)(SPI= (?P[^)]+)" | rex "(?i)(user= (?P[^)]+)" | rex "(?i) and (?P[^ ]+)" | eval Date_Time = date_mday." ".date_month." ".date_year." ".date_hour.":".date_minute.":".date_second | transaction SPI | table UserName, SourceIP, Date_Time, duration | eval duration = round(duration/(60*60), 2) | rename duration as "SessionTime(Hour)"

0 Karma

RK_sp1unk
New Member

i have already tried all this sonicwall apps and add ons this are useless not loading any data

can some one help me how can i fliter vpn authentication logs from syslog or /var/log

0 Karma

RK_sp1unk
New Member

or if someone has used sonicwall firewall and generated VPN reports please share the query or spl

0 Karma

RK_sp1unk
New Member

this is the old query with cisco firewall tried chnagng soure cetypes but no data

0 Karma

RK_sp1unk
New Member

it is really disappointing no one knows the answer for the above query

0 Karma

woodcock
Esteemed Legend

Find the SPL that generates the report and run it. From the bottom, one by one, remove each pipe and the SPL after it until you get results. Then look at what is in the line that you removed and fix whatever is in it that doesn't exist.

0 Karma

RK_sp1unk
New Member

Please share the SPL

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...