Dashboards & Visualizations

How does splunk react to dynamic assets?

benjamin009
Explorer

Here is my question.

List A has 150 hosts. Imported 3 weeks ago. Mostly static addresses, some dynamic
List B has 300 hosts. Imported 1 week ago. Some static, most dynamic

How does splunk handle the following:

1) If there is an asset in List A but not List B, does Splunk remove the asset or does it keep it?
2) If there is an updated DNS or IP address, does it create two entries for that specific assets?

-Specifically if there is a host with an updated dynamic IP address, does it keep both entries?
-If there is an old IP address in Splunk that is reused and now becomes a static IP address for a server, what DNS would Splunk show?
3) If there are assets in List A and List B, does it duplicate the asset entry?

Tags (2)
0 Karma
1 Solution

aweitzman
Motivator

Splunk doesn't remove anything unless you tell it to. All 450 entries will be there. The ones from list A will have a different timestamp from list B.

View solution in original post

aweitzman
Motivator

Splunk doesn't remove anything unless you tell it to. All 450 entries will be there. The ones from list A will have a different timestamp from list B.

benjamin009
Explorer

So when I run a search string for a DNS host that had an IP address change from list A to B, it would show both addresses in the log, just a different time stamp?

0 Karma

benjamin009
Explorer

Thank you, that helps me a lot!

0 Karma

aweitzman
Motivator

You're welcome.

(Friendly tip: Next time, you should consider accepting the actual answer rather than your own followup question.)

0 Karma

aweitzman
Motivator

(You should add comments rather than new answers when asking followups to answers.)

Yes, that's exactly what would happen, you'd get a history of each host's IP address.

If that's not what you want, and you only want the most current host IP address to show up in your searches, you might consider writing your list out as a CSV file, overwriting it each time you generate it, and then use lookup to refer to it from Splunk. This will explain more fully what I'm talking about: http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/Addfieldsfromexternaldatasources

Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...