I want to know if there's a way to tie all of the IP addresses from the logs of each asset and call it 'IP_Address' or something. Same thing with MAC addresses, FQDN, and other unique identifiers so we can accurately track machines reporting in our network. Is this a possibility?
Short answer: yes
Longer answer: we need to understand your desired end state
Full answer: if the data's in Splunk, AND YOU KNOW WHAT IT IS, you can get it out and do all kinds of neat things with it … but you have to know what field(s) you're looking for in each sourcetype, how you intend to correlate them, what – exactly – you want to "know" when you're done, etc
February 06, 2020 at 12:41PM
via reddit https://www.reddit.com/r/Splunk/comments/ezv6ay/newbie_question_about_a_splunk_capability/fgps1ib?utm_source=ifttt