About sinhashubham014

yuanliu · ‎03-05-2024

I have a suspicion that you misspelled either account_id or aws_account_id in the macro because the way you presented, the resultant subsearch is NOT (). Are you sure you copied the above search verbatim into index search and you get the correct result that is NOT the same as using the macro? Further, which fieldname exists in actual data? aws_account_id or account_id? For example, if account_id exists AND if you intend to match account_id in index data with "Account ID" in the lookup, your macro should be something like search [inputlookup Account_Owners.csv |rename "Account ID" as account_id |search Environment IN (PROD, UAT, ) |table account_id] Hope this helps.

richgalloway · ‎12-26-2023

Don't modify the datamodel. If you do then your local copy will override any future changes delivered by Splunk. First, make sure the data in your "process" events apply to the Endpoint DM. There may be too few common fields to make the DM useful. If there is sufficient coverage in the DM for your data then use tags to ensure the DM finds the process events in its searches. Define fieldaliases and EVALs as needed to make the data CIM-compliant.

gcusello · ‎12-11-2023

HI @sinhashubham014 , which ESCU Use Cases are triggered? Why isn't the result you want? Ciao. Giuseppe

Posts	5
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎12-10-2023

Online Status	Offline
Date Last Visited	‎03-05-2024 03:50 PM

Macros not fetching data

Linux Logs

Windows Logs in Endpoint data model

Re: Macros not fetching data

Re: Linux Logs

Re: Windows Logs in Endpoint data model

Are you a member of the Splunk Community?