topic Re: monitoring directory files in Getting Data In

monitoring directory files

neroi — Tue, 11 Sep 2018 07:31:15 GMT

Hello!
Need help with monitoring
We monitor the directory and load from the text files the data of the following format:

http://immage.biz/image/SVoO

We need to complete the record of information about the IP address with resolve by name of the PC (armName) after adding the event data.
How to make such an enrichment and also remove some of the fields that do not carry useful information for us?

Re: monitoring directory files

richgalloway — Tue, 11 Sep 2018 11:20:00 GMT

Your image of the data is broken. Please try copy-paste rather than inserting an image.

Re: monitoring directory files

neroi — Tue, 11 Sep 2018 12:17:51 GMT

thanks for your comment.
Edited

Re: monitoring directory files

richgalloway — Tue, 11 Sep 2018 15:17:44 GMT

You can enrich your data using lookup using either DNS or a local lookup file. To use DNS:

... | lookup dnslookup clienthost as armName OUTPUT clientip as armIP | ...

To use a local file you will need a CSV file with two fields: armName and armIP. Upload that file to your search head and use this SPL:

... | lookup armlookup.csv armName OUTPUT armIP | ...

Use the fields command to remove unwanted fields at search time.

... | fields - field6 field7 | ...

There are ways to prevent indexing of fields at index time, but we'd have to know about how you ingest this file. Share your props.conf settings, if you can.

Re: monitoring directory files

neroi — Wed, 12 Sep 2018 13:14:39 GMT

Hello! Thank you for answer.

We use the first method now. But it gets the value of the address at the current moment when the search query occurs. And we need to store the value obtained at the time of receiving the data.

Re: monitoring directory files

neroi — Tue, 18 Sep 2018 08:58:15 GMT

any comment to this question?