Splunk Enterprise Security
Highlighted

Splunk Enterprise Security: How to associate business software to an asset?

Explorer

I have a .csv which contains a list of business applications, the app owner, the server(hostname or same as nthost) the app is installed on and the software's risk rating.
What I need to do is take the application(s) and the app owner(s) and associate them to the nt
host in our assets.
I currently have the file installed as a lookup but not sure how to proceed.

0 Karma
Highlighted

Re: Splunk Enterprise Security: How to associate business software to an asset?

SplunkTrust
SplunkTrust

The regular Splunk tutorial may or may not have an example (I don't know for sure), but here's one that you can follow to get a reasonable example of how to do these things.

A close reading of the docs for lookup may also suggest at least things to try.

One thing you might need to do is make sure you have a field to join them up on - nt_host is fine, but it would have to be on both sides (not necessarily with the same name - just the contents.)

... | lookup TheNameOfMyLookup FieldInLookup1 AS FieldNameInEvent1 OUTPUT appowner AS MyNewAppOwnerName application AS MyNewApplicationName

It's just a sample, but hopefully this gets you started.

Happy Splunking,
Rich

0 Karma