Splunk Enterprise Security

Variable host names for asset lookup

ebs
Communicator

In the Splunk environment some of the assets have variable host names. Is there a way we can map an additional 'host' field from the json data when normalising so that they can match a fixed asset lookup?

0 Karma
1 Solution

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

View solution in original post

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...