Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do you set action in Email CIM?

$
0
0
One of the fields in the Email CIM is action. From the Proofpoint-On-Demand pps_messagelog I want to change final_action to action. I've tried using the below in TA-pps_ondemand/local/props.conf FIELDALIAS-pod_final_action = final_action AS action and EVAL-action = final_action The field alias didn't do anything. The eval caused an error when I tried to deploy. The version of Splunk is 7.2.5.1 installed on-site. Frankly I'm baffled by this one. Either works if I have it in the SPL in search. Any suggestions? TIA, Joe

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>