Splunk Enterprise Security

update asset list

riqbal47010
Path Finder

I have asset list associated with ES. Now I want to remove the assets from the list if they are not reporing more than 60 days.
I have inital query in my mind as below:"

 | inputlookup asset_lookup.csv | eval host=nt_host | join type=left host [ | metadata type=hosts ] | table host lastTime | eval time=strftime(lastTime, "%b %d %T %Y %Z") 

I would like to know that is this is a a good practice..?
2nd below are my thoughts that why I wnat to remove those assets from asset list.
1- As most of the servers are vm servers. after some time once the project is comleted the vm admins either remove the vm or assign that vm to some other with different hostname and different IP address.

0 Karma
1 Solution

DavidHourani
Super Champion

Hi @riqbal47010,

In order to change your asset list for ES make sure you modify it at the source and not only by running some manual search time actions.

If you're building that list via a scheduled search, so make sure to modify that search and include the changes to suppress any hosts that haven't reported for 60 days.
More info on editing the base search here :
https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Examplemethodsofaddingassetandidentitydata

Let me know if that helps.

Cheers,
David

View solution in original post

0 Karma

DavidHourani
Super Champion

Hi @riqbal47010,

In order to change your asset list for ES make sure you modify it at the source and not only by running some manual search time actions.

If you're building that list via a scheduled search, so make sure to modify that search and include the changes to suppress any hosts that haven't reported for 60 days.
More info on editing the base search here :
https://docs.splunk.com/Documentation/ES/5.3.1/Admin/Examplemethodsofaddingassetandidentitydata

Let me know if that helps.

Cheers,
David

View solution in original post

0 Karma

riqbal47010
Path Finder

manual works 🙂

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!