Hi All,
I am facing an issue with logs from juniper SRX and ES. I am pretty new to splunk, i am hoping the answer would be an easy one to this.
I have a field called protocol-id with numeric values for the protocols e.g. 1,6,17 which are actually ICMP, TCP and UDP respectively. ES doesn't recognize the numeric values and in the ports and protocol dashboard.
I did the following but it's not working:
Please let me know if this is the correct way or should i use another strategy.
Thanks!
If you can uniquely id the field/value. you could use SEDCMD
replace the values
http://docs.splunk.com/Documentation/Splunk/6.4.3/Data/Anonymizedata#Anonymize_data_through_a_sed_sc...