monitoring directory files

[neroi]

Hello!
Need help with monitoring
We monitor the directory and load from the text files the data of the following format:

http://immage.biz/image/SVoO

We need to complete the record of information about the IP address with resolve by name of the PC (armName) after adding the event data.
How to make such an enrichment and also remove some of the fields that do not carry useful information for us?

[richgalloway · Accepted solution]

You can enrich your data using lookup using either DNS or a local lookup file. To use DNS:

... | lookup dnslookup clienthost as armName OUTPUT clientip as armIP | ...

To use a local file you will need a CSV file with two fields: armName and armIP. Upload that file to your search head and use this SPL:

... | lookup armlookup.csv armName OUTPUT armIP | ...

Use the fields command to remove unwanted fields at search time.

... | fields - field6 field7 | ...

There are ways to prevent indexing of fields at index time, but we'd have to know about how you ingest this file. Share your props.conf settings, if you can.

[neroi]

Hello! Thank you for answer.

We use the first method now. But it gets the value of the address at the current moment when the search query occurs. And we need to store the value obtained at the time of receiving the data.

[neroi]

any comment to this question?

[richgalloway]

Your image of the data is broken. Please try copy-paste rather than inserting an image.

[neroi]

thanks for your comment.
Edited