Currently using splunkes' managed lookup table called hosts. There's a field too called hostname within the file. I'm trying to create a search where if results under "query" field matches anything under hostname, then alert or show results. here's what I have so far.. index=opendns [ | inputlookup hosts | search hostname | table hostname query] ... View more

Creating alerts using InfoSec App, adaptive response set to email, but in the email body i'm trying to query src, dest and action fields. I've tried everything such as $src$, with/without quotes, dollar sign but still not working. anything will help! ... View more