Splunk Enterprise Security

Variable host names for asset lookup

ebs
Communicator

In the Splunk environment some of the assets have variable host names. Is there a way we can map an additional 'host' field from the json data when normalising so that they can match a fixed asset lookup?

0 Karma
1 Solution

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

View solution in original post

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...