Hello
I have pre-parsed information coming into my Splunk instance for CISCO:ASA. I'm wondering why the field "direction" has a value of "inbound" showing up as "inbound" and "Inbound". How can I combine the two? Do I want to combine the two?....seems like it...
Thanks
Tim
↧