Splunk ITSI
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Service entities: Why can't I find a way to filter by Entity Type?

h_garcia
Loves-to-Learn
‎03-07-2022 02:21 PM

Hello everyone,

when I imported the entities, the operating system family value was mapped to 'Entity Type'.

I'm currently setting up a couple services, one for Linux and another for Windows. In the Entity Rules builder, I can't find a way to include a condition 'Entity Type matches Windows Server'.

Is it really so? (bit suprised).

It seems to me I'll have to re-import the entities (using the update option) with an extra field for OS Family and set it as informational field.

Any hints or tips are welcome!

Thanks!

Labels (1)
Labels
Tags (3)
0 Karma
Reply
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...