topic Re: add devices into multiple groups in Knowledge Management

add devices into multiple groups

sherrysafdar — Tue, 05 Feb 2019 17:33:16 GMT

We have 10 different sites and I would like to create a group for each site.

For example, I want to add SITE-A devices in SITE-A group and SITE-B devices in SITE-B group to be visible.

Please help, thanks!

Re: add devices into multiple groups

BainM — Tue, 05 Feb 2019 17:56:54 GMT

Hi sherrysafdar -
Could you please be a little more specific? Where do the groups apply? Deployment Server groups? I could guess, but that won't help you.

Re: add devices into multiple groups

chrisyounger — Tue, 05 Feb 2019 18:08:35 GMT

One way to do this is to create and automatic lookup. The structure of the CSV would be like so:

host,  group
host1, group1
host2, group1
host3, group1
host4, group2
host5, group3

With an automatic lookup, everytime you search on a sourcetype, the "group" field will be automatically added to every event.

Hope this helps

Re: add devices into multiple groups

sherrysafdar — Tue, 05 Feb 2019 20:15:15 GMT

BainM, we have multiple Fortinet firewalls and we would like to separate each firewall in the search hope that clarify your question?

Re: add devices into multiple groups

sherrysafdar — Tue, 05 Feb 2019 20:57:35 GMT

Can you give an example for automatic lookup?

Re: add devices into multiple groups

chrisyounger — Tue, 05 Feb 2019 21:18:07 GMT

You need to do this: https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Usefieldlookupstoaddinformationtoyourevents

and then this: https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/DefineanautomaticlookupinSplunkWeb

All the best

Re: add devices into multiple groups

sherrysafdar — Tue, 29 Sep 2020 23:10:08 GMT

I need to identify 192.168.100.1 as Texas_Firewall and 192.168.200.1 as California_Firewall.

This is what I am trying to accomplish.

And later if in future there are more firewalls in Texas I can simply add them to the Texas_Firewall group or whatever it is.

I am also quite not sure how can I be able to write the query at this point but need to accomplish first task first.

Thanks,

Re: add devices into multiple groups

sherrysafdar — Wed, 06 Feb 2019 14:41:43 GMT

Quick question is that possible using tags?

Re: add devices into multiple groups

chrisyounger — Tue, 29 Sep 2020 23:06:13 GMT

You could use "eventtypes" if you like. create an eventtype called "firewalls_texas" , "firewalls_california" etc