AnsweredAssumed Answered

customize feed ip address only reference to ip.src or ip.dst

Question asked by huan zhou on Jan 20, 2014
Latest reply on Apr 5, 2016 by pbLIdKlYvbBgo8kdKjrKwU2jRwsX1GZqAvdEvcaKjzA=

we're using SA for log, we identified a few devices(device.ip meta) which we want to use feed, tried to create the feed using csv (without xml definition), but there is no values, checked the documents, seems it can only reference to ip.src or ip.dst? how to make it refrence to device.ip?

 

Or is there any steps missing?

 

Below is the sample csv:

192.168.0.1,firewall1

192.168.0.2,firewall2

192.168.0.3,firewall3

 

Thank you.

Outcomes