EXTRACT-mac = device-mac=(?<deviceMac>[^,]+) EXTRACT-type = device-type=(?<deviceType>[^,]+) ... View more

i found the first problem Automatic lookups  this  'LOOKUP-cisco_asa_ids_lookup' use app TA-alfa_firepower and permited for all app i change permissions for TA-alfa_firepower only. is this good idea? ... View more

cool Glad to help you 🙂 !! Happy Splunking !! ... View more

@Dmitriy  index=alfa [|inputlookup IIN_oleg.csv | dedup IIN |table IIN | format "(" "(" "AND" ")" "OR" ")" The assumption is IIN field is also in alfa index events. If you need further help, I will suggest to post new question with your requirement. KV   ... View more

Thanks for help ... View more

Hi @Dmitriy, Did you try to search your index with All Time in timerange? Maybe there is an error on timestamps on your DBConnect setup. ... View more