Dear all,
In the environment there are two affilaites/plants with 5 machines each (total 10, 8 endpoint, 2 mcafee server). We have the each side mcafee server integrated with our splunk which tells us about the latest DAT file on them. The environment is dynamic and there will be new endpoints added and old removed also.
I want two things to be monitored in the most efficent way through lookup( my real environment is huge):-
1) I want to create a lookup that will keep track of all the endpoints along with last report date. Kindly help me with both the query i.e one for creating lookup another for comparing it with real time data.
2) I want to monitor the latest DAT file updated on endpoint with the help of lookup. for this I will be using 1 lookup that keeps track of latest DAT version amongst the machine in the environment and store it for e.g value 10. Now compare this value through query in realtime data.
Help me with sample queries please.
I have mcafee endpoint data coming in.
