In splunk how CMDB fields mapped.

[kingbert_Thomas]

In splunk how we create these CMDB fields mapped to any sourcetype when new host added as asset..

like the below fields, if we don't have C

CRITICITY
ENVIRONMENT
FUNCTION
OFFER
BUSINESS UNIT
CODEREF
DATACENTER

[isoutamo]

There are already some proposals how this could maybe do. But to understand better your situation and which solution is best for you, we should know more about your needs, used tools, environment and what is your target for this.

• How you are collecting data?
• Are you managing all inputs?
• Have you some other tools where you have some kind of CMDB?
• How you are deploying inputs?
• Are you using Splunk's ARI?

If you are managing all inputs then maybe the easiest way to add this is use _meta field on those inputs. Just add those values in all input stanzas and then you have those events in your data when it comes into Splunk indexers.

Other options are just use e.g. tags when you are onboarding data sources into splunk as already mentioned.

As you see there is many ways to do it, and without more information it's impossible to say how you should do it.

r. Ismo

[kiran_panchavat]

@kingbert_Thomas 

1. Create and Save a Search:

   • Create a search that returns the necessary information for your CMDB fields.
   • Save this search as a report and schedule it to run regularly.

2. Create Lookup Definitions:

   • Go to Settings > Lookups > Lookup definitions and create a new lookup definition.
   • Choose the destination app and select the output lookup CSV file from your saved search.

3. Configure Data Enrichment:

   • In the Enterprise Security app, navigate to Configure > Data Enrichment > Asset & Identity.
   • Create a new configuration and select the lookup name you created.

4. Map CMDB Fields:

   • Map the fields from your lookup to the corresponding CMDB fields like CRITICITY, ENVIRONMENT, FUNCTION, OFFER, BUSINESS UNIT, CODEREF, and DATACENTER.

[jarvisstark]

You can create these CMDB fields in Splunk by using lookup tables or event-type tagging to map metadata to new hosts. If you don’t have a CMDB, consider using an asset inventory lookup or automatic field extractions in props.conf to enrich incoming data.