I am building an index and would like to get some sample data, specifically Cisco Ironport Web data that contains a user, URL and domain fields.
Hi pbugeja!
PRO TIP! : Splunk built TAs usually contain a sample directory! Gives you an idea what we used to build the TAs!
Check out the Cisco WSA TA, it has a few goodies in there! Hopefully one fits your needs!
https://splunkbase.splunk.com/app/1747/
Hi Asimagu,
I appreciate your reply, but I had reviewed the logs on the OSSEC site and was not able to find the appropriate log that contained the fields needed.
/Paul
you could try this: http://ossec-docs.readthedocs.io/en/latest/log_samples/