search

spicosolutions / thepeoplessiem

Patronus Support Portal
0 stars 0 forks source link

Asset Tracker - Lookup Gen #41

Closed jward51 closed 2 years ago

jward51 commented 2 years ago

Suggested updated query :

index=_internal NOT host = splunkcloud |stats max(_time) as lastSeen by host |inputlookup append=true ss_asset_tracker |dedup host sortby - lastSeen | eval host = lower(host) |table host lastSeen |outputlookup ss_asset_tracker

cmutt78 commented 2 years ago

added the exclusion for cloud systems but leaving host intact