Getting Data In

How can I add src_asset_tag to my inventory?

New Member

I have a master asset list and I need to give them tagging so that when I type something like src_asset_tag=firewall I should get all source as firewall in logs.

0 Karma

Ultra Champion

If i understand your question you want to map an asset tag (lets say ID0001) to a device. (I assume 'firewall' is your hostname)

Create a CSV file which maps your assets like so:


upload and add this file as a lookup file - assets.csv
Define a lookup table - AssetsLookup.

You can now use the Lookup to populate a form on a dashboard, and allow your users to select an asset ID.
The input will give you the hostname, so you can build a dashboard which searches


If this is not enough detail - let me know and i'll try and come back with more detailed info when i am back at my desk

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...