All Apps and Add-ons

Trackme, how to change default priorities based on a tag

New Member


is it possible to change the default priority of  data source(s) in the TrackMe app using a tag which is defined in TrackMe?



Labels (2)
Tags (1)
0 Karma


Hi @lmcgchr 

See the following issue:

In a nutshell you could easily create your own workflow, with a scheduled report handling this:


| inputlookup trackme_data_source_monitoring | eval keyid=_key
| search data_name="firewall:pan:traffic"
| eval tags_expanded=tags
| makemv delim="," tags_expanded
| eval priority=if(tags_expanded="CIM", "high", priority)
| fields - tags_expanded
| outputlookup append=t key_field=keyid trackme_data_source_monitoring

--> Create a report using a similar logic
--> schedule this report to run on a regular basis, daily for example

What it does is loading the collection, creating an expanded version of the tags, defining the priority, and updating the values.
Everything else will be preserved y the outputlookup.


0 Karma
Get Updates on the Splunk Community!

Running multiple macros in the same search

Hi all!I'm trying to run multiple macros in the same search and eventually aggregate the results from each ...

tag as datamodel attribute

I'm confused a bit. I use CIM datamodels.The "tag" field is both a filter for choosing events applicable to a ...

Index with one sourcetype - search performance / best practices

Hello,I have created a few indexes, each containing data only from one source with one sourcetype.<BR />From a ...