Splunk Search
Highlighted

Data wherehousing - Can Splunk report on previous device-account mapping?

Splunk Employee
Splunk Employee

Suppose that I have events for my devices being splunked and each device is associated with an account ID located in a database.

We have a scenario as follows:

  • - A device starts out associated with one account (say account “A”) from Feb-March
  • - The device THEN gets re-associated to another account (say Account “B”) in April

    Reports generated for Feb-March must associate the Account “A” database information with the device, whereas any report after March must associate the Account “B” database information with the device.

    How would splunk handle this scenario and/or need to be setup to enforce these reporting requirements? Any experience or best practices would be greatly appreciated.
  • Highlighted

    Re: Data wherehousing - Can Splunk report on previous device-account mapping?

    Splunk Employee
    Splunk Employee

    Hey Maverick,

    For this one you'd want a time-based lookup. See docs here: http://www.splunk.com/base/Documentation/latest/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_...

    Look for other answers for best practices on this.

    D

    Highlighted

    Re: Data wherehousing - Can Splunk report on previous device-account mapping?

    Splunk Employee
    Splunk Employee

    So you are saying I could match the event time on a temporal month and year based field? If so, then I could maintain the new mappings as they change in the lookup file, correct?

    0 Karma