Getting Data In

monitoring directory files

neroi
Explorer

Hello!
Need help with monitoring
We monitor the directory and load from the text files the data of the following format:

http://immage.biz/image/SVoO

We need to complete the record of information about the IP address with resolve by name of the PC (armName) after adding the event data.
How to make such an enrichment and also remove some of the fields that do not carry useful information for us?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

You can enrich your data using lookup using either DNS or a local lookup file. To use DNS:

... | lookup dnslookup clienthost as armName OUTPUT clientip as armIP | ...

To use a local file you will need a CSV file with two fields: armName and armIP. Upload that file to your search head and use this SPL:

... | lookup armlookup.csv armName OUTPUT armIP | ...

Use the fields command to remove unwanted fields at search time.

... | fields - field6 field7 | ...

There are ways to prevent indexing of fields at index time, but we'd have to know about how you ingest this file. Share your props.conf settings, if you can.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You can enrich your data using lookup using either DNS or a local lookup file. To use DNS:

... | lookup dnslookup clienthost as armName OUTPUT clientip as armIP | ...

To use a local file you will need a CSV file with two fields: armName and armIP. Upload that file to your search head and use this SPL:

... | lookup armlookup.csv armName OUTPUT armIP | ...

Use the fields command to remove unwanted fields at search time.

... | fields - field6 field7 | ...

There are ways to prevent indexing of fields at index time, but we'd have to know about how you ingest this file. Share your props.conf settings, if you can.

---
If this reply helps you, Karma would be appreciated.

neroi
Explorer

Hello! Thank you for answer.

We use the first method now. But it gets the value of the address at the current moment when the search query occurs. And we need to store the value obtained at the time of receiving the data.

0 Karma

neroi
Explorer

any comment to this question?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your image of the data is broken. Please try copy-paste rather than inserting an image.

---
If this reply helps you, Karma would be appreciated.
0 Karma

neroi
Explorer

thanks for your comment.
Edited

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...