https://community.splunk.com/t5/Deployment-Architecture/Splunk-recognizing-devices/m-p/557673#M18948 <P>It depends.&nbsp; If the device name is in the data then normal Splunk field extractions can pull it out then apply the Common Information Model (CIM) to give the field a recognized name.</P><P>If the name is not in the log then the IP address can be used to fetch the device name from a lookup file.</P> Tue, 29 Jun 2021 19:55:30 GMT richgalloway 2021-06-29T19:55:30Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-recognizing-devices/m-p/557618#M18942 <P>Hey y'all, a quick question for the Splunk community and perhaps the developers.</P><P>How does Splunk or any SIEM solution recognize a device name from raw data logs? I've been scratching my head trying to figure that out.&nbsp;</P><P>&nbsp;</P> Tue, 29 Jun 2021 14:28:25 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-recognizing-devices/m-p/557618#M18942 raimuhammad 2021-06-29T14:28:25Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-recognizing-devices/m-p/557673#M18948 <P>It depends.&nbsp; If the device name is in the data then normal Splunk field extractions can pull it out then apply the Common Information Model (CIM) to give the field a recognized name.</P><P>If the name is not in the log then the IP address can be used to fetch the device name from a lookup file.</P> Tue, 29 Jun 2021 19:55:30 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-recognizing-devices/m-p/557673#M18948 richgalloway 2021-06-29T19:55:30Z