search

guilhemmarchand / trackme

TrackMe - Data tracking system for Splunk admins
Apache License 2.0
49 stars 11 forks source link

Data host tracking in bulk #390

Closed predator2-c3 closed 2 years ago

predator2-c3 commented 2 years ago

Hello, We are trying to monitor all of our firewalls as hosts with trackme. We have about 50 firewalls. Is there a way to bulk update the priority of each firewall to high. Versus manually going to each firewall and changing the priority to high? We want to monitor each firewall with the alert 'TrackMe - Alert on data host availability'.

guilhemmarchand commented 2 years ago

Hi @predator2-c3

Have a look here: https://trackme.readthedocs.io/en/latest/FAQ.html#can-the-priority-be-externally-managed

TrackMe stores entities in KVstores, you basically can interract with this in SPL and bulk edit things lke priority:

Ex:

| inputlookup trackme_host_monitoring | eval key=_key
| search data_host=xxxx*
| eval priority="high"
| outputlookup trackme_host_monitoring append=t key_field=key

The next generation of TrackMe will come with builtin bulk edit capabilities within the UI, but inline SPL will always make sense too.

Feel free to close the issue if this answered properly to your question.

Guilhem

guilhemmarchand commented 2 years ago

Assuming this answered your questiion - bulk edit will builtin in TrackMe v2