Splunk Enterprise Security

Variable host names for asset lookup

ebs
Communicator

In the Splunk environment some of the assets have variable host names. Is there a way we can map an additional 'host' field from the json data when normalising so that they can match a fixed asset lookup?

0 Karma
1 Solution

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

View solution in original post

lkutch_splunk
Splunk Employee
Splunk Employee

I believe the answer is that it depends. Which version of ES are you using? Also, are the variable hostnames unique to the asset or do they overlap across assets? 

The nt_host is a multivalue key field, so theoretically yes. However... If you have a source file with duplication in the key fields, and you can't groom the file to make sure that the information belongs to the same asset, then they get merged. In earlier versions of ES, there was no context for how to resolve the overlapping key field values. The first host that matched in the collection was the only one you would see in your search results. But as of 6.0, they merge instead.  

You can add or change fields for the merge:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Assetsettings#Add_or_edit_an_asset_field 

If you're not on 6.0 or higher, take note of the following if/when you upgrade:
https://docs.splunk.com/Documentation/ES/6.4.0/Admin/Manageassetsandidentititiesuponupgrade 

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...