Hi In that case, review your WAF setting as per the F5 Add-on +Splunk documentation Configure F5 Logging Profiles for ASM docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup    Regards, Sajid ... View more

index=f5_index sourcetype=* req_status="blocked" attack_type=* | chart count(req_status) by attack_type or index=f5_index sourcetype=* attack_type=* req_status="blocked" | table f5_bigip_server_host, support_id, req_status, attack_type, violations, ip_client ... View more

index=wineventlog (EventCode=4624 OR EventCode=4625) | transaction Account_Name, Workstation_Name startswith="EventCode=4625" endswith="EventCode=4624" maxspan=120s | search EventCode=4624 EventCode=4625 Account_Name!="-" | table _time Account_Name, Workstation_Name ... View more

index=wineventlog (EventCode=4624 OR EventCode=4625) | transaction Account_Name, Workstation_Name startswith="EventCode=4625" endswith="EventCode=4624" maxspan=120s | search EventCode=4624 EventCode=4625 Account_Name!="-" | table _time Account_Name, Workstation_Name ... View more