Assuming you have your data source onbaording done ( inputs.conf ) and field extractions (including making customerids a multivalued field) working (a big if?), you do it with very straight-forward SPL syntax like this: latitude=xx.xx longitude=-xx.xx absoluteLatitude=40.541656 absoluteLongitude=-79.826348 severity=1 ... View more

i have already read that PDF file couple of times 🙂 ... View more

even i am getting same issue plz suggest me ... View more

I downvoted this post because the nss config guide does not have configuration steps for the "zscaler app for splunk" it only demonstrates how to configure the nanolog streaming service to send logs via syslog in cim format. the documentation for this app is poor. ... View more

Typically you would install our TA on the indexer and the app on the search head. TA found here: https://apps.splunk.com/app/1904/ Shoot me an email via the feedback menu inside the FireEye app and we can discuss the details of the issue. ... View more