Hello,
I am new to splunk and have not started the evaluation yet but wanted to ask this question that may be obvious.
Let's say Firewall-1 sends logs to splunk with the source IP defined as "src IP"
Firewall-2 sends logs to splunk with source IP defined as "source IP"
Would splunk automatically place it into a common filed? If so, what would that field be called? If splunk can't place it into a common field what would an admin have to do to accomplish that?
