I am able to sync my data from the Cisco managed S3 bucket to a local folder on my heavy forwarder.  The files are comma delimited with  double quotes. With a comma and empty double quotes to show the end of the line (maybe)? Example:  "date time stamp","user","internal ip address","" So how do I create the custom event types to get the source and destination IP Addresses.   ... View more