-
Notifications
You must be signed in to change notification settings - Fork 3
Home
MAC Address Vendor Scripted Lookup for Splunk
This app provides a scripted lookup to resolves MAC addresses to their manufacturer locally using python's netaddr library (https://pypi.python.org/pypi/netaddr/) and requires no configuration. Simply install the app on your search head and use like so: ... | lookup lookup macvendor mac AS src_mac OUTPUT vendor AS src_mac_vendor
- Release notes
- Support and resources
- Requirements
- Installation
- Configuration
Version 0.1.* of TA-macvendor is compatible with:
| Splunk Enterprise versions | 6.3+ |
|---|---|
| Platforms | Platform independent |
| Lookup file changes | None |
- None
- None
Please post questions at https://answers.splunk.com, however this app is provided as is with no warranty, implied or otherwise; please see the LICENSE document for more information. Feedback about possible improvements and good news stories of how this app has helped your organisation are most welcome.
- None
To function properly, TA-macvendor requires the following software:
- Splunk Enterprise 6.3+
Simply install this app on your search head/s.
N.B. If you receive an error from the indexer servers in a search when using the lookup immediately after installation of the app, please wait a few minutes for bundle replication then the error will disappear.
No configuration is required.
The macvendor lookup can be used like so:
... | lookup lookup macvendor mac AS src_mac OUTPUT vendor AS src_mac_vendor