up

buixor · buixor · commit fc8fc0303c82 · 2025-12-02T09:30:07.000+01:00
diff --git a/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md b/crowdsec-docs/unversioned/cti_api/api_integration/integration_splunk_siem.md
@@ -47,6 +47,10 @@ All output fields have the prefix `crowdsec_{field}_`. For event with multiple I
 ![Example Output (3)](/img/splunk_siem/splunk_siem_multiple_ips.png)
 
 
+:::info
+Fields containing multiple IP values aren't supported.
+:::
+
 ## Enriched Data
 
 The following fields are automatically enriched using **CrowdSec** intelligence:
