I have NMAP data in Splunk that reports on open ports associated with a list of IP addresses. I'd like to create a lookup that I can then use to query against and alert/report on in a new query that runs every night. Any suggestions on how to structure the lookup and/or the resulting query?
↧