we're using SA for log, we identified a few devices(device.ip meta) which we want to use feed, tried to create the feed using csv (without xml definition), but there is no values, checked the documents, seems it can only reference to ip.src or ip.dst? how to make it refrence to device.ip?
Or is there any steps missing?
Below is the sample csv:
192.168.0.1,firewall1
192.168.0.2,firewall2
192.168.0.3,firewall3
Thank you.
i got it work by using call back device.ip, so it's correct the ip address only index for ip.src and ip.dst.