Getting Data In

monitoring directory files

neroi
Explorer

Hello!
Need help with monitoring
We monitor the directory and load from the text files the data of the following format:

http://immage.biz/image/SVoO

We need to complete the record of information about the IP address with resolve by name of the PC (armName) after adding the event data.
How to make such an enrichment and also remove some of the fields that do not carry useful information for us?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can enrich your data using lookup using either DNS or a local lookup file. To use DNS:

... | lookup dnslookup clienthost as armName OUTPUT clientip as armIP | ...

To use a local file you will need a CSV file with two fields: armName and armIP. Upload that file to your search head and use this SPL:

... | lookup armlookup.csv armName OUTPUT armIP | ...

Use the fields command to remove unwanted fields at search time.

... | fields - field6 field7 | ...

There are ways to prevent indexing of fields at index time, but we'd have to know about how you ingest this file. Share your props.conf settings, if you can.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can enrich your data using lookup using either DNS or a local lookup file. To use DNS:

... | lookup dnslookup clienthost as armName OUTPUT clientip as armIP | ...

To use a local file you will need a CSV file with two fields: armName and armIP. Upload that file to your search head and use this SPL:

... | lookup armlookup.csv armName OUTPUT armIP | ...

Use the fields command to remove unwanted fields at search time.

... | fields - field6 field7 | ...

There are ways to prevent indexing of fields at index time, but we'd have to know about how you ingest this file. Share your props.conf settings, if you can.

---
If this reply helps you, Karma would be appreciated.

neroi
Explorer

Hello! Thank you for answer.

We use the first method now. But it gets the value of the address at the current moment when the search query occurs. And we need to store the value obtained at the time of receiving the data.

0 Karma

neroi
Explorer

any comment to this question?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your image of the data is broken. Please try copy-paste rather than inserting an image.

---
If this reply helps you, Karma would be appreciated.
0 Karma

neroi
Explorer

thanks for your comment.
Edited

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...