Splunk Enterprise Security

Variable host names for asset lookup

ebs
Communicator

In the Splunk environment some of the assets have variable host names. Is there a way we can map an additional 'host' field from the json data when normalising so that they can match a fixed asset lookup?

0 Karma
1 Solution

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

View solution in original post

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...