The Teleseer Custom CSV Parser allows a user to upload a comma-separated value (CSV) formatted file with information to add to an asset. Any CSV row that matches an existing asset by IP address or MAC address will be adorned with tags for each column value in that same row. Several reserved column names allow the user to directly update asset attributes.

The Teleseer CSV parser supports two types of CSV files: Hardware List and Splunk.

Hardware List CSV

• Required Columns (case-insensitive):
  • machine name
  • ip address
  • manufacturer

• All other columns are treated as tags in the format column_name: value where value is the value for that column in the asset row.

How It Works:

• Assets are matched by IP address
• The following columns map to specific asset attributes:
  • "machine name" → hostname
  • "ip address" → ip (does not overwrite existing values)
  • "manufacturer" → manufacturer
• All other columns are added as tags (e.g., column_name: value).

Splunk CSV

• Required Columns (case-insensitive):
  • os
  • dns
  • function
  • ip
  • mac
  • nt_host

• Extra Columns: Allowed; treated as tags in the format column_name: value.

How It Works:

1. Assets are matched by IP address or MAC address.
2. The following columns map to specific asset attributes:
   • "os" → OS Name
   • "dns" → hostname
   • "function" → roles
   • "ip" → ip (does not overwrite existing values)
   • "mac" → mac (does not overwrite existing values)
   • "nt_host" → hostname
3. If both dns and nt_host are present, they are added as multiple hostnames for the asset.
4. All other columns are added as tags (e.g., column_name: value).

General Notes

• The parser is case-insensitive for column headers.
• Extra columns are never ignored—they are added as tags in the key: value format.

Example CSVs and Interpretation

Hardware List Example

Interpretation of Hardware List Rows

1. Row 1:
   • Match: Asset matched by IP address = 192.168.1.10.
   • Mapped Fields:
     • hostname → Server1
     • manufacturer → Dell
   • Tags Added:
     • location: Datacenter A
     • rack: Rack 1
2. Row 2:
   • Match: Asset matched by IP address = 192.168.1.11.
   • Mapped Fields:
     • hostname → Server2
     • manufacturer → HP
   • Tags Added:
     • location: Datacenter B
     • rack: Rack 2
3. Row 3:
   • Match: Asset matched by IP address = 192.168.1.12.
   • Mapped Fields:
     • hostname → Server3
     • manufacturer → Lenovo
   • Tags Added:
     • location: Datacenter A
     • rack: Rack 3

Splunk Example

Interpretation of Splunk Rows

1. Row 1:
   • Match: Asset matched by IP = 192.168.1.11 or MAC = 00:1A:2B:3C:4D:5E.
   • Mapped Fields:
     • OS Name → Linux
     • hostname → server1.com
     • roles → Web Server
     • mac → 00:1A:2B:3C:4D:5E
   • Tags Added:
     • department: IT
     • app: Apache
2. Row 2:
   • Match: Asset matched by IP = 192.168.1.12 or MAC = 00:1A:2B:3C:4D:5F.
   • Mapped Fields:
     • OS Name → Windows
     • hostname → server2.com
     • roles → File Server
     • mac → 00:1A:2B:3C:4D:5F
   • Tags Added:
     • department: Finance
     • app: SMB
3. Row 3:
   • Match: Asset matched by IP = 192.168.1.13 or MAC = 00:1A:2B:3C:4D:60.
   • Mapped Fields:
     • OS Name → macOS
     • hostname → server3.com
     • roles → Dev Server
     • mac → 00:1A:2B:3C:4D:60
   • Tags Added:
     • department: Engineering
     • app: Xcode