Find all log devices sending content

[RSAAdmin]

All,

SA newb here.  Our current deployment uses a syslog aggregator that send all logs from the aggregator to SA.   I'd like to generate a report that shows all the devices that have ever sent logs to SA - -however, the way I tried to do this only showed the aggregator as the source.  Is there a way for me to generate this report that shows the originating IP/asset and not the aggregator?

Thanks,

Favabean

[huanzhou1]

which log forwarder you using? did you check on the log decoder - stats?

[RSAAdmin]

Hi,

Check out this thread How to override "device.ip" meta with the right one?

Hope it helps