Hi Splunkers ,
any advice how to avoid mixng values in assets by
I have 5 fileds marked as Multivalue (category, ip, mac) and sometimes it cause trouble like multiple assets mapped to all existing categories or multiple IP addresses, and thus incorrect notable events.
Do I understand correctly that I should mark fields as Multivalue if there might be several valuse (like 2 mac addresses for computer or several categories (router|network) ?
SE V7.3.3, Enterprise Security Version 6.0.1 Build 2