Splunk recognizing devices

[raimuhammad]

Hey y'all, a quick question for the Splunk community and perhaps the developers.

How does Splunk or any SIEM solution recognize a device name from raw data logs? I've been scratching my head trying to figure that out. 

[richgalloway]

It depends.  If the device name is in the data then normal Splunk field extractions can pull it out then apply the Common Information Model (CIM) to give the field a recognized name.

If the name is not in the log then the IP address can be used to fetch the device name from a lookup file.