Hi all ,
Can we create local variables , like in Arcsight (were in we can pull value using substring from a field) . if yes ... can any one help in how to create and use custom variables ?
You might want to ask this question in the SIEM community. Or a moderator can move your post to the matching place.