Good Morning, I have a query that I'd like to refine. I'm new to Splunk. So the current query that I'm running is used to identify when people outside of the country connect to our VPN. index=company_logs "Client Type: Cisco AnyConnect VPN Agent" | iplocation src | stats dc(src) by Country So this works fine for giving us a tally as to how many total connections are initiated out of the country. I'd like to get more granular and have a breakdown by username. This is the field that contains the username: Cisco_ASA_user. How can I adjust the query to include that data? Thanks! ... View more

Good Afternoon. My organization uses Cisco AnyConnect. We're concerned that some users may be connecting to our network from out of the country. We'd like to get alerts as to when this happens.  Has anyone ever set up such alerts before? I would like some guidance. I know the Public IP of our network, however I'm not sure how to drill down in our logs to identify the inbound traffic to it. If I try to list the IP address as the source IP in one way or another, the connections turn up blank. Does anyone have any suggestions? Thanks.  ... View more