topic Variable substitution not working in correlation search? in Splunk Enterprise Security

Variable substitution not working in correlation search?

tromero3 — Wed, 30 Sep 2020 05:00:26 GMT

I have a correlation search for detecting when host stops sending logs. I enabled the search and set the title as below but when I receive the notables, my results show the hostname of the search head as the $host$ instead of the actual host who stopped sending logs. When I expand the notable, it does show the correct host under the "Additional Fields" section, just not in the title of the notable. The $Latest_Time$ doesn't work either, I'm not sure if it's possible to even use that or what I would have to put so it shows the Latest_Time / Last Time Reported field. Any help would be greatly appreciated!

Title of correlation search:
"Host $host$ stopped sending logs since $Latest_Time$"

Query:
| metadata type=hosts index=*| where relative_time(now(), "-1d") > lastTime AND lastTime > relative_time(now(), "-90d") | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup asset_lookup_by_str nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit |rename Latest_Time AS "Last Time Reported"

Re: Variable substitution not working in correlation search?

richgalloway — Mon, 13 Apr 2020 20:54:21 GMT

I'm not sure why $host$ is not working, but $Latest_Time$ doesn't work because there is no such field. It's renamed to $Last Time Reported$ .

Re: Variable substitution not working in correlation search?

tromero3 — Mon, 13 Apr 2020 21:07:45 GMT

Okay I changed the $Latest_Time$ to $Last Time Reported$ and that part is now fixed. Thank you!

Re: Variable substitution not working in correlation search?

tromero3 — Wed, 15 Apr 2020 15:12:58 GMT

So it looks like the issue was that I needed to use $orig_host$ to get the original host from the actual events. $host$ was just getting the search head hostname (maybe due to the metadata command?).

Re: Variable substitution not working in correlation search?

neerajs_81 — Wed, 21 Sep 2022 04:21:59 GMT

@tromero3 I ran into the very same issue with $host$ not working . Pls advise how did you come up with $orig_host$ field ?