Knowledge Management

Can I track devices and DAT version through lookup?

Path Finder

Dear all,

In the environment there are two affilaites/plants with 5 machines each (total 10, 8 endpoint, 2 mcafee server). We have the each side mcafee server integrated with our splunk which tells us about the latest DAT file on them.  The environment is dynamic and there will be new endpoints added and old removed also.

I want two things to be monitored in the most efficent way through lookup( my real environment is huge):-

1) I want to create a lookup that will keep track of all the endpoints along with last report date. Kindly help me with both the query i.e one for creating lookup another for comparing it with real time data.

2) I want to monitor the latest DAT file updated on endpoint with the help of lookup. for this I will be using 1 lookup that keeps track of latest DAT version amongst the machine in the environment and store it for e.g value 10. Now compare this value through query in realtime data.

Help me with sample queries please.


I have mcafee endpoint data coming in.

Labels (1)
Tags (1)
0 Karma


What does your data look like? What have you tried so far? What's wrong with your attempts?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...