No worries, please accept this answer if it addressed your need. Thanks! ... View more

syslog contains src and dst fields with IP address as value. The goal is to identify src that talks to dst matching any of the IPs in the two lists. The query works as intended, but it would be also nice to know which list contains matching dst IP. This is being taken from getwatchlist app. ... View more

This wiki page is also useful: http://www.splunk.com/wiki/Community:TroubleshootingIndexedDataVolume ... View more