Splunk ESS: Why does drilldown notable not working?

saveriobocca — Sat, 23 Jan 2021 04:58:13 GMT

Hi everyone,
I have a specific question for all of you.

In Splunk ESS I created a correlation search and a notable for the monitoring Incident Review section.

I have set up a specific notable with drilldown to which I pass a field of the CS (Corralation Search) to perform the specific search and display via the Statistics tab.

Corralation Search:

index=* (statusCode=4* OR statusCode=5*) | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID

Notable Drilldown

index=* (statusCode=4* OR statusCode=5*) | search sourceIp="$sourceIp$" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID

When I open the drilldown from the Notable screen, the following query is returned:

Instead of:

index=* (statusCode=4* OR statusCode=5*) | search sourceIp="129.12.x.x" | rename "requestTime" as Time, "statusCode" as Status, "sourceIp" as SourceIp, "httpMethod" as HttpMethod, "endpointRequestId" as "EndpointReqID" | stats values(Status) as Status, values(HttpMethod) as HttpMethod, count by index, SourceIp, EndpointReqID

Why is the $sourceIp$ field not recognized and replaced with the IP address of the CS so that it can perform a specific search?

What is the error?

Thank you all!

Re: Splunk ESS | Drilldown notable not work

alonsocaio — Fri, 22 Jan 2021 17:24:31 GMT

Hey @saveriobocca , just confirming, on your first search (Correlation Search) you have renamed sourceIp to SourceIp. Have you tried using "$SourceIp$" instead of "$sourceIp$" on your drilldown search?

Field names are case-sensitive, so if the token is generated as SourceIp on the correlation search it needs to be the same way on the drilldown.

Re: Splunk ESS | Drilldown notable not work

saveriobocca — Fri, 22 Jan 2021 21:57:07 GMT

Hi @alonsocaio thank you for the response.

Yes, after this I tried to write the variable like this "$SourceIp$" but it doesn't work again.

What do you think it could be?
It almost seems that the value is not passed to the variable.

topic Splunk ESS: Why does drilldown notable not working? in Alerting

Splunk ESS: Why does drilldown notable not working?

Re: Splunk ESS | Drilldown notable not work

Re: Splunk ESS | Drilldown notable not work