Splunk Enterprise Security

Variable host names for asset lookup

ebs
Path Finder

In the Splunk environment some of the assets have variable host names. Is there a way we can map an additional 'host' field from the json data when normalising so that they can match a fixed asset lookup?

0 Karma
1 Solution

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

View solution in original post

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!