Knowledge Management

Tags - Auto tagging from a csv

jnguyen413
New Member

Looking to see if this is possible or if there are any other alternatives.

Goal: I am using tags as a search filter for role access and I am looking for an automated way to manage this. Servers may be decommissioned or new servers may pop up so I want to automate as much as possible. An example would be providing an application owners access to ONLY OS logs, web server logs, etc to their application only.

Background: We have indexes for windows logs, unix logs, web server logs, etc, so we cannot have separate indexes for applications. We have an automated job to produce a csv from our CMDB that tells us what application is mapped to which server, so how can we use that to auto-tag?

0 Karma

HighJustice
Engager

I would recommend to use either automatic lookups or define an event types with proper tags to have an "automatic tagging"

sloshburch
Ultra Champion

No trivial way to auto-tag that I can think of. I think an alternate approach would be to use lookups to associate other fields with those events.

Although, if you have a criteria for determining a tag association within a csv, then you can use that same info to define eventtypes and therefore tags...

Feel free to post a scrubbed example and we get make this question more tangible.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...