Fixed incorrect mac field (#31)

fixes #30
splunk · Nov 22, 2022 · 1db9e8f · 1db9e8f
2 parents ec16687 + acb128f
commit 1db9e8f
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/SA-CrowdstrikeDevices/default/savedsearches.conf b/src/SA-CrowdstrikeDevices/default/savedsearches.conf
@@ -12,7 +12,7 @@ dispatch.latest_time = -1m@m
 enableSched = 1
 schedule_window = auto
 search = `sa_crowdstrike_index` sourcetype="crowdstrike:device:json" \
-| dedup falcon_device.device_id mac \
+| dedup falcon_device.device_id falcon_device.mac_address \
 | rename falcon_device.local_ip as ip \
 | eval \
     category=replace(replace(mvjoin(mvsort(lower(mvappend(\