Splunk Creating eventtypes from csv to name VLANS
Splunk Creating eventtypes from csv to name VLANS Everyone got the VLAN name lookup working from the last post? You did.. ? Really someone is listening? Next lets use the information in the internal_networks.csv file to create event types and really change the way we search in splunk. While researching this topic, I learned that you CAN NOT do subsearches in eventtypes.conf I was hoping to do something like (dont try it it doesnt work) eventtypes.conf [vlan:Guest] search src_ip=172.30.21.0/24 |lookup vlan network AS src_ip OUTPUT name AS Src_VLAN So I had to find an easy way to parse our csv. I love trying to do all my heavy lifting on one line in linux. So I challenged myself.. can it be done? As a reminder here is our internal_networks.csv I have cleaned it up to conform with the common information model the best I could. No spaces in the names and no capital letters. network,name "192.168.1.0/24","corporate" "192.168.2.0/24","voice" "...