index=pan* dvc_name="*" sourcetype="pan:traffic" OR sourcetype="pan:system" how can I trigger an email alert if example 1 or multiple devices are not sending traffic logs after 24hrs. I tried using the alert with condition number of results but it's not sending logs. because splunk counts the result not by device and by logs it added all the results. ... View more

Hi all, im new in splunk, i was wondering if you can help me. This is  the scenario, im using inputlookup. I have csv  file with 2 fields field1 is original ip then field 2 is second ip. What i wanted to do if the user get one of ip address in field 1 and  get any ip address in the field 2 then it will alert. But if the user only get ip address in field 1 and did not get ip address in field2 it will not alert. I have multiple ip address in field 1 and only 4 ip address in field 2. Thank you ... View more