I want to create rule which will take output from one rule and use it in
a new
rule.***********************************************************Rule 1-
Select event.time, ip.src, country.src, ip.dst, ip.dstport, action,
event.desc Where event.desc con...
Hey Chris. That was helpful. Thank you very much. Can you please help me
to understand how can i achieve this" What I might do, is create a
simple application rule and push it out to all my log decoders. That
way, meta would be created at the point o...
