Knowledge Management

Can I track devices and DAT version through lookup?

Path Finder

Dear all,

In the environment there are two affilaites/plants with 5 machines each (total 10, 8 endpoint, 2 mcafee server). We have the each side mcafee server integrated with our splunk which tells us about the latest DAT file on them.  The environment is dynamic and there will be new endpoints added and old removed also.

I want two things to be monitored in the most efficent way through lookup( my real environment is huge):-

1) I want to create a lookup that will keep track of all the endpoints along with last report date. Kindly help me with both the query i.e one for creating lookup another for comparing it with real time data.

2) I want to monitor the latest DAT file updated on endpoint with the help of lookup. for this I will be using 1 lookup that keeps track of latest DAT version amongst the machine in the environment and store it for e.g value 10. Now compare this value through query in realtime data.

Help me with sample queries please.


I have mcafee endpoint data coming in.

Labels (1)
Tags (1)
0 Karma

Ultra Champion

What does your data look like? What have you tried so far? What's wrong with your attempts?

0 Karma
Get Updates on the Splunk Community!

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...