I have a Cisco VPN (not sure exactly which hardware) whose logs are forwarded to our Splunk server. It appears the username is redacted. All I see are asterisks. Is this something that can be changed on the VPN and how? Hopefully there is enough consistency between devices that the question can be answered. Thanks!
IP xx.xx.xx.xx _raw Jun 26 10:23:31 xx.xx.xx.xx %ASA-6-113005: AAA user authentication Rejected : reason = Invalid password : server = xx.xx.xx.xx : user = ***** : user IP = xx.xx.xx.xx _time 2014-06-26T10:23:31.000-0400 app date_hour 10 date_mday 26 date_minute 23 date_month june date_second 31 date_wday thursday date_year 2014 date_zone local eventtype host xx.xx.xx.xx ids_type index main linecount 1 pid process %ASA-6-113005 product punct __::_..._%--:_____:__=___:__=_..._:__=_*****_:___= reason Invalid server xx.xx.xx.xx source syslog sourcetype syslog splunk_server xx.xx.xx tag::eventtype timeendpos 15 timestartpos 0 user ***** vendor