CMDB Lookup Integration

Introduction to the CMDB Lookup Integration in TrackMe

The CMDB Lookup integration was introduced in TrackMe Version 2.0.57 and provides the following services:

  • In the TrackMe user interface, quick access to the CMDB Lookup feature to provide context and third-party information related to a TrackMe entity

  • TrackMe administrators can define a flexible CMDB external integration with dynamic token replacements

  • The CMDB Lookup search can use any kind of Splunk Processing Language (SPL) statement, such as searching in a CSV or KVStore based lookup, or calling any Splunk command

  • The configuration is made at the system level per TrackMe component, and can be fine-tuned per tenant relying on token variables replacements

  • Finally, the integration relies on the built-in TrackMe command trackmesplkcmdb which processes and executes the CMDB Lookup logic

CMDB Lookup Feature Overview in the TrackMe User Interface

The TrackMe CMDB Lookup feature is available to TrackMe users by clicking on the CMDB icon in the Tabulator:

overview01.png

The CMDB Lookup integration screen opens and TrackMe automatically executes the integration logic:

overview02.png

In the background, TrackMe executes the CMDB logic via a built-in SPL command and using information from the component, tenant and entity, example:

overview03.png

The CMDB Integration logic is defined at the system-wide configuration level:

overview04.png

For instance:

| inputlookup my_cmdb where (index="$data_index$" AND sourcetype="$data_sourcetype$")

TrackMe automatically expands and replaces the token values from the entity data.

Any data returned by the CMDB integration will be part of the SPL results in the CMDB Lookup screen.

Configuring the CMDB Lookup Search Logic

TrackMe administrators can configure the CMDB Lookup integration search at the system level, per TrackMe component. Access:

  • “Configure” / “spk-general” / Scroll down to the CMDB integration searches

configure01.png configure02.png

The CMDB Lookup search template is specific per component and contains any number of token variables to be replaced. For instance, for the splk-dsm component, it is by default:

| inputlookup my_cmdb where (index="$data_index$" AND sourcetype="$data_sourcetype$")

This default template does the following logic:

  • A Splunk lookup transform named “my_cmdb” is available in Splunk and in the context of the TrackMe application (you can of course use your own lookup name!)

  • Several filters defined as tokens will be replaced automatically by TrackMe. In the default template, it expects a field describing the index as well as a field describing the sourcetype

  • The lookup then renders any number of fields and information that is relevant for your context, such as the owner, contact information, etc.

The CMDB Lookup search integration can also use any SPL command and is not necessarily restricted to the use of a Splunk lookup.

In some specific contexts, you could therefore use a custom command of yours, or another SPL command that interacts with a third party such as ServiceNow, Jira, or your ITSM tool.

Token Variables Replacements

When TrackMe calls the trackmesplkcmdb command, the following logic is executed:

  • The command receives in input a list of arguments such as the component, the tenant identifier, and the object identifier

  • The command retrieves the CMDB Lookup integration search template from the TrackMe configuration

  • It then processes the token variables replacements accordingly and executes the search transparently

  • Results are provided in a JSON format and rendered by the CMDB integration screen

  • It also investigates the results and renders a “no results found” specific message if the search did not render any results for this entity

Calling the Command Manually

The custom command trackmesplkcmdb accepts the following arguments:

Argument

Description

Default

Mandatory

component

The TrackMe component. Syntax: component=. Matches pattern: ^(?:dsm|dhm|mhm|cim|flx|wlk)$

(No default value provided)

Yes

tenant_id

The tenant identifier. Syntax: tenant_id=

None

Yes

object

The TrackMe object value. Syntax: object=

(No default value provided)

No

object_id

The TrackMe object identifier. Syntax: object_id=

(No default value provided)

No

Notes: TrackMe uses the object_id argument which is in fact the KVStore key identifier of the record. When calling the command manually, you can call object_id or object, but not both.

Troubleshooting the CMDB Integration Lookup Feature

TrackMe logs the activity of the command trackmesplkcmdb in the following sourcetype:

index=_internal sourcetype=trackme:custom_commands:trackmesplkcmdb

If the search fails for any reason, an exception would be raised and logged. The output of the exception will also be rendered in the JSON results in the CMDB integration screen.

Finally, you can also observe the runtime performance and the search that TrackMe executed:

troubleshoot01.png

Disabling the CMDB Integration for a Given TrackMe Tenant

You can disable the CMDB lookup integration for an existing Virtual Tenant by editing the tenant account preferences:

  • “Configure” / “Virtual Tenants preferences”

Then edit the Virtual Tenant account you want to disable the feature for and scroll down to the option:

disable01.png disable02.png

When disabled, TrackMe will not show the CMDB integration icon anymore for that Virtual Tenant.