Hi, I'm using eventgen to create sample data. Whenever someone runs a command, the Linux audits will record the event over multiple lines. For example, if someone uses sudo to run 'cat /etc/shadow'. The audit log will record the user's attempt to access sudo, then another line that will show the authentication status (success or failure), then the actual command, '/etc/shadow', etc... Is there a way to set the token replacement to change the username, hostname, time, command for that event and do it, say 30 times. Each event which has multiple lines with have the same username, hostname, time and command. Then the next event will have a different username, hostname, time and command? Thanks, Bruce ... View more

Hi, We have different version of Solaris (8, 9, 10 and 11) and we would like to take the BSM audits and ingest them into Splunk. I know there's an old version of the solaris-bsm-audit-log-loader_14 which was written in 2011 for Splunk ver4. We tried it and it doesn't work. Does anyone have a script that will ingest these audit logs into Splunk? Thanks, Bruce ... View more