We have 10 different sites and I would like to create a group for each site.
For example, I want to add SITE-A devices in SITE-A group and SITE-B devices in SITE-B group to be visible.
Please help, thanks!
One way to do this is to create and automatic lookup. The structure of the CSV would be like so:
host, group
host1, group1
host2, group1
host3, group1
host4, group2
host5, group3
With an automatic lookup, everytime you search on a sourcetype, the "group" field will be automatically added to every event.
Hope this helps
Quick question is that possible using tags?
You could use "eventtypes" if you like. create an eventtype called "firewalls_texas" , "firewalls_california" etc
I need to identify 192.168.100.1 as Texas_Firewall and 192.168.200.1 as California_Firewall.
This is what I am trying to accomplish.
And later if in future there are more firewalls in Texas I can simply add them to the Texas_Firewall group or whatever it is.
I am also quite not sure how can I be able to write the query at this point but need to accomplish first task first.
Thanks,
Can you give an example for automatic lookup?
You need to do this: https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Usefieldlookupstoaddinformationtoyourev...
and then this: https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/DefineanautomaticlookupinSplunkWeb
All the best
Hi sherrysafdar -
Could you please be a little more specific? Where do the groups apply? Deployment Server groups? I could guess, but that won't help you.
BainM, we have multiple Fortinet firewalls and we would like to separate each firewall in the search hope that clarify your question?