Join the Conversation
- Find Answers
- :
- Splunk Products
- :
- Splunk Enterprise Security
- :
- Config assets in SplunkES
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
When I config assets in SplunkES, I have a problem which concern field pci_domain.
I have read the document but I don't understand clearly about this field : the purpose and effect of this field in SpunkES ?
Besides, if i have a asset which not belong pci scope, I need fill what in filed pci_dmain ?
I hope everyone will help my with this case.
Thanks everyone.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
An empty/null should be fine.
Please find a sample
ip,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av,
10.31.111.130,,myhost-01,myhost-01.domain.com,,medium,,,London,United Kingdom,IT,CATEGORY1,cardholder,TRUE,TRUE,TRUE,TRUE,TRUE
10.31.111.131,,myhost-02,myhost-02.domain.com,,medium,,,London,United Kingdom,IT,NON_CAT,,TRUE,TRUE,TRUE,TRUE,TRUE
you can get some hint by Looking into lookups of the APP SA-IdentityManagement/lookups/pci*
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
An empty/null should be fine.
Please find a sample
ip,mac,nt_host,dns,owner,priority,lat,long,city,country,bunit,category,pci_domain,is_expected,should_timesync,should_update,requires_av,
10.31.111.130,,myhost-01,myhost-01.domain.com,,medium,,,London,United Kingdom,IT,CATEGORY1,cardholder,TRUE,TRUE,TRUE,TRUE,TRUE
10.31.111.131,,myhost-02,myhost-02.domain.com,,medium,,,London,United Kingdom,IT,NON_CAT,,TRUE,TRUE,TRUE,TRUE,TRUE
you can get some hint by Looking into lookups of the APP SA-IdentityManagement/lookups/pci*
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much.
But actually I don't understand clearly about this field : the purpose and effect of this field in SpunkES ?
Can you explain detail for me ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
please upvote/accept if these answers helped you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
pci_domain=> The domain of the host as it pertains to PCI. The domain is used to identify instances where cardholder data may pass to Internet-facing devices, such as for PCI requirement 1.3.3.An asset can be included in multiple PCI domains by assigning a pipe-delimited list of domains in the asset list.
This field is used for grouping of Identities by Priority and/or Business Unit and Category and used by SA-IdentityManagement add-on of the SPlunkES
So it is quite important for security posture of your organisation. Traditionally it used to be part of splunkES, but since there is an exclusive PCI app now, i'm not sure about the future of this field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks koshyk very much. I will upvote for this answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If an asset does not have PCI scope then you can leave the pci_domain field empty. The field is used in the Asset Center dashboard.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much.
But actually I don't understand clearly about this field : the purpose and effect of this field in SpunkES ?
Can you explain detail for me ?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Observability Simplified: Combining User Experience, Application Performance & ...
Event Series May & June: From Network Visibility to Service Intelligence
Global Splunk User Group Events: May + June 2026
