I think I have made some progress. index="sophos_central" "Event::Endpoint::Application::Detected" | table name, endpoint_type, location, when, customer_id, sub_estate, group That search gives me this which is correct. I have now realised that I can add the sub_estate field from the Interesting Fields to the Selected Fields and that does what I want it to do. I can now see the sub_estate in every search. Thanks for the help. ... View more

I ran this search index="sophos_central" "Event::Endpoint::Application::Detected" and got the following result. This is the customer_id I wanted to change index=_internal sourcetype=splunkd didn't seem to show any errors ... View more

I think I have cracked it. I think the data coming into index could come in and miss the alert. I have now tweaked the alerts to be cron jobs and I am collecting the data a little more quickly, 15 minutes instead of 20. Thanks for the help. ... View more

If I make a Table the Automatic Lookup works. If I do a search for index="sophos_central" I see what I would call the raw data and that field is still the GUI. ... View more

I have been checking them minutes after they should trigger. If they should trigger at 20 minutes past the hour I was checking at 25 minutes past. I have changed them to cron jobs now rather than the GUI x past the hour option. One has already triggered. ... View more

I have made some progress. I have setup an Automatic Lookup and this works on a search that I table, but not on a raw search. Is that the best I will get? ... View more

Thanks for the reply. That has worked well. I was hoping it would replace the field in all searches, but I have managed to get it to work with this search index="sophos_central" "Event::Endpoint::Application::Detected" | lookup sub_estate_lookups.csv customer_id OUTPUT Name | table name, endpoint_type, location, when, customer_id sub_estate, group Is it possible to replace the field by default whenever it is found? ... View more

Thanks Damien. I will take a look at this on Friday. ... View more

I have finally got back to this. Sorry for all the questions, but I appreciate the help. I assumed that I would paste in the Header API key or API Access URL + Headers into the setup page, but I am not seeing a place for that. The URL is obvious, but where do the API tokens go? With only two to choose from I thought it would be simple? Any other pointers would be most welcome. ... View more

Thanks for the replies. I will take a look at that and confirm the answer once tested. I like the look of the Rest API. I was hoping to get the data straight in to Splunk rather than download the file and get the data from there. ... View more

Thanks for the reply. My first issue is getting the script to run. How do I get the script add to at least run once? ... View more