Splunk CMDB Lookup

[amit1791yadav]

We want to override the lookup File as per the below condition.

If File not exist - we don't want to override the lookup file.
And IF File exist - We can proceed to override the lookup file .

index=siem_test sourcetype="db:cmdb"
| timechart count by source

IF CMDB part not lost don't override the output lookup and how do we can check the sourcetype is not reporting.

Please suggest any condition which we can use in our search query to populate the result.

[lekanneer]

This is why I developed a solution to overcome the problem of lookups and/or indexes and/or complex searches. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need.

I wrote a post about that recently: SOCs: why they struggle with context