Network Toolkit - Question

[ricky_riswanto]

Hi All, 

Needs your info and suggestion, can we use this app https://splunkbase.splunk.com/app/3491/#/details  to get network hierarchy automatically? like network auto discovered? 

If not, does splunk has network auto discovery feature or mechanism?

[lekanneer]

I think it is better to import network communcation logs and then update them in my solution.

If you're looking for an efficient and functional ServiceNow to Splunk integration (also CMDB) take a look at: https://www.thedutchdatadifference.nl/splunk-servicenow/

I created that solution and continuously adding new features. It is meant to host all sorts of nodes and relationships. And I can imagine that the network communication logs can be one of them. And then even combine with what is already defined in CMDB.

[Spranta]

Hi Ricky,

as far as i know the network toolkit doesn't have any autodiscovery features.
We are creating are our input for the network toolkit from a csv file, so if you have any tool that is able to create a csv or whatever you can for example use a python script to feed the inputs.conf

Alex

[ricky_riswanto]

Hi Alex,

Thanks for your response, understand your point to create input.conf file. But somehow if we need to define all ip address into input.conf manually then it will not efficient.

Btw, can we use "traceroute" operation to collect route ip and gets flow network?      

[Spranta · Accepted solution]

You can, for example, create a script that pings  a whole subnet and write the output into a csv so you can use this to create the inputs.conf automatically, or you might have a cmdb that can create such a csv?

[ricky_riswanto]

Hi Alex,

Yes agree cmdb if better option for master data reference ip address. So we can lookup into cmdb then convert into input.conf file. Btw, did fping available on input.conf?

[Spranta]

No i don't think that fping is available.