Getting Data In

How can I add src_asset_tag to my inventory?

rahul_acc_splun
New Member

I have a master asset list and I need to give them tagging so that when I type something like src_asset_tag=firewall I should get all source as firewall in logs.

0 Karma

nickhills
Ultra Champion

If i understand your question you want to map an asset tag (lets say ID0001) to a device. (I assume 'firewall' is your hostname)

Create a CSV file which maps your assets like so:

assettag,hostname
ID0001,firewall
ID0002,router01
ID0003,email-server

upload and add this file as a lookup file - assets.csv
Define a lookup table - AssetsLookup.

You can now use the Lookup to populate a form on a dashboard, and allow your users to select an asset ID.
The input will give you the hostname, so you can build a dashboard which searches

host=$asset.hostname$

If this is not enough detail - let me know and i'll try and come back with more detailed info when i am back at my desk

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...