CMDB Lookup Integration

Introduction to the CMDB Lookup up integration in TrackMe

The CMDB Lookup integration was introduced in TrackMe Version 2.0.57 and provides the following services:

In the TrackMe user interface, quickly access to the CMDB Lookup up feature to provide context and third party information related to a TrackMe entity
TrackMe administrators can define a flexible CMDB external integration with dynamic token replacements
The CMDB Lookup up search can any kind of Splunk Processing Language (SPL) statement, such as searching in a CSV of KVStore based lookup, or calling any Splunk command
The configuration is made at the system level per TrackMe component, and can be fine tuned per tenant relying on token variables replacements
Finally, the integration relies on the builtin TrackMe command trackmesplkcmdb which processes and executes the CMDB Lookup up logic

CMDB Lookup feature overview in the TrackMe user interface

The TrackMe CMDB Lookup up feature is available to TrackMe users by clicking on the CMDB icon in the Tabulator:

The CMDB Lookup integration screen opens and TrackMe automatically executes the integration logic:

In the background, TrackMe executes the CMDB logic via a builtin SPL command and using information from the component, tenant and entity, example:

The CMDB Integration logic is defined at the system wide configuration level:

For instance:

| inputlookup my_cmdb where (index="$data_index$" AND sourcetype="$data_sourcetype$")

TrackMe automatically expands and replaces the tokens value, from the entity data.

Any data returned by the CMDB integration will be part of the SPL results in the CMDB Lookup up screen.

Configuring the CMDB Lookup up search logic

TrackMe administrators can configure the CMDB Lookup up integration search at the system level, per TrackMe component, access to:

“Configure” / “spk-general” / Scroll down till the CMDB integration searches

The CMDB Lookup up search template is specific per component and contains any number of token variables to be replaced, for instance and for the splk-dsm component, it is by default:

| inputlookup my_cmdb where (index="$data_index$" AND sourcetype="$data_sourcetype$")

This default templates does the following logic:

A Splunk lookup transforms named “my_cmdb” is available in Splunk and in the context of the TrackMe application (you can of course use your own lookup name!)
Several filters defined as tokens will be replaced automatically by TrackMe, in the default template it expects a field describing the index as well as a field describing the sourcetype
The lookup then renders any number of fields and information that relevant for your context, such as the owner, contact information, etc

The CMDB Lookup search integration can also use any SPL command, and is not necessarily restricted to the use of a Splunk lookup.

In some specific contexts, you could therefore use a custom command of yours, or another SPL command that interacts with a third party such as ServiceNow, Jira, or your ITSM tool.

Token variables replacements

When TrackMe calls the trackmesplkcmdb command, the following logic is executed:

The command receives in input a list of arguments such as the component, the tenant identifier and the object identifier.
The command retrieves the CMDB Lookup integration search template from the TrackMe configuration
It then processes to the token variables replacements accordingly and execute the search transparently
Results are provided in a JSON format and rendered by the CMDB integration screen
It also investigates the results and renders a “no results found” specific message if the search did not render any results for this entity

Calling the command manually

The custom command trackmesplkcmdb accepts the following arguments:

Argument	Description	Default	Mandatory
component	The TrackMe component. Syntax: component=. Matches pattern: ^(?:dsm\|dhm\|mhm\|cim\|flx\|wlk)$	(No default value provided)	Yes
tenant_id	The tenant identifier. Syntax: tenant_id=	None	Yes
object	The TrackMe object value. Syntax: object=	(No default value provided)	No
object_id	The TrackMe object identifier. Syntax: object_id=	(No default value provided)	No

Notes: TrackMe uses the object_id argument which is in fact the KVstore key identifier of the record, when calling the command manually, you can call object_id or object, but not both.

Troubleshooting the CMDB integration lookup up feature

TrackMe logs the activity of the command trackmesplkcmdb in the following sourcetype:

index=_internal sourcetype=trackme:custom_commands:trackmesplkcmdb

If the search fails for any reason, an exception would be raised and logged, the output of the exception will also be rendered in the JSON results in the CMDB integration screen.

Finally, you can also observe the run time performance and the search that TrackMe executed:

Disabling the CMDB integration for a given TrackMe tenant

You can disable the CMDB lookup integration for an existing Virtual Tenant by editing the tenant account preferences:

“Configure” / “Virtual Tenants preferences”

Then edit the Virtual Tenant account you want to disable the feature for and scrolldown till the option:

When disabled, TrackMe will not show the CMDB integration icon anymore for that Virtual Tenant.