I have been asked to capture user login information from our SN instance and I am not sure how to get that data into Splunk. I have the SN add-on installed and I see lots of audit information once someone logs in, but I do not see login info such as username, success or failure and src ip. Can that info be pulled into Splunk? Any idea how?
Thanks!
for anyone interested you can get this information by turning on access to syslog_transaction table in the SN add-on inputs section under inputs. Ne warned it is a lot of data and you can only pull 1000 events per collection interval so plan accordingly.
for anyone interested you can get this information by turning on access to syslog_transaction table in the SN add-on inputs section under inputs. Ne warned it is a lot of data and you can only pull 1000 events per collection interval so plan accordingly.