We have a requirement to setup ping and nslookup for hosts in different network zones and index the data into Splunk.
Planning to use the ping and nslookup search commands that comes with Network Toolkit TA used along with Splunk map command as below.
| inputlookup hostlist.csv| fields host
| map search=“| ping dest=“$host$” index=index name” max searches=50000
do a similar one for nslookup as well instead of ping.
The will be setup as a schedule saved search to run every 5 mins. The hosts can be maximum around 50000.
Do you think we can use map for this scale? If not what is the optimal rows (search running every 5 mins) be used with map command for this to work efficiently?
Are there any other better options to setup this in Splunk?
