topic How to compare two values on same row in Security

How to compare two values on same row

Tomers — Wed, 23 Feb 2022 16:41:58 GMT

Hey,

I have a rule, that report to me each time source stop sending logs to my splunk.

I try to make an exception, that when a specific source from a specific host will stop sending logs, it wont trigger an alert.

for example:

i will get alerts from

host=* source=*

but not when its

host=windows31 source=application

Is it possible to do that? because i try to work on it for a few days already.

Re: Compare two values on same row

gcusello — Wed, 23 Feb 2022 11:23:10 GMT

Hi @Tomers,

I could help you better if you could share your search, also because it isn't clear for me how your rule works.

Anyway, you could add the second condition to your search:

index=your_index NOT(host=windows31 source=application) | ...

if you have many of these conditions, you could put them in a lookup (called e.g. exceptions.csv with two columns called host and source) and use the lookup to filter your results.

index=your_index NOT [ | inputlookup exceptions.csv | fields host source ] | ...

Ciao.

Giuseppe

Re: Compare two values on same row

Tomers — Wed, 23 Feb 2022 11:43:29 GMT

Thank you! It does work now

for some reason that is the only thing i didnt think of.

FYI-

My search is(i only added the condition lines here)-

|tstats latest(_time) as _time where index=* by sourcetype host

|where _time<relative_time(now(), "-1h")

|fields sourcetype host _time

Re: Compare two values on same row

gcusello — Wed, 23 Feb 2022 11:47:36 GMT

Hi @Tomers,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉