Knowledge Management

How can I populate a host tag from an external source?

jedatt01
Builder

I have a list of hosts that are assigned to a tag so the user doesn't have to input the list of hosts manually in search. These hosts are changed occasionally and I have an external system that manages those changes. Is there any way to pull the host changes from the external system (which has an api) and dynamically populate my tags instead of manually changing them.

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can edit tags through Splunk's REST API: http://docs.splunk.com/Documentation/Splunk/latest/RESTREF/RESTknowledge#search.2Ftags

If you need Splunk to be the active "pulling" part, you could build a scripted or modular input that runs on a schedule, queries your external source, makes REST calls accordingly (and logs to Splunk, obviously).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...