Splunk Enterprise Security

Splunk CMDB Lookup

New Member

We want to override the lookup File as per the below condition.

If File not exist - we don't want to override the lookup file.
And IF File exist - We can proceed to override the lookup file .

index=siem_test sourcetype="db:cmdb"
| timechart count by source

IF CMDB part not lost don't override the output lookup and how do we can check the sourcetype is not reporting.

Please suggest any condition which we can use in our search query to populate the result.

Labels (1)
Tags (1)
0 Karma

Loves-to-Learn Lots

This is why I developed a solution to overcome the problem of lookups and/or indexes and/or complex searches. My solution is using a Neo4j graph database in between the source of the information and Splunk. The good thing of the graph database is that it is capable of searching for relationships or the lack of relationships. So you can even combine several sources to give you the context that you need.

I wrote a post about that recently: SOCs: why they struggle with context 

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...