topic Re: correlation search variable doesn't work in my incident review in Alerting

correlation search variable doesn't work in my incident review

gwen — Fri, 17 Nov 2023 10:53:42 GMT

hello,

i have a correlation search with variable that does'nt work

| stats count by host

| eval hello_world = host

when im looking in incident review, my alerte show $hello_word$ and not my values host.

Can you help me please ?

splunk ver 7.3.5

Re: correlation search variable doesn't work in my incident review

gcusello — Fri, 17 Nov 2023 11:30:55 GMT

Hi @gwen,

sorry but I don't understand what you mean with variable.

A Correlation Search is an alert, so you canno pass a token to it.

Could you share your complete Correlation Search source code?

Ciao.

Giuseppe

Re: correlation search variable doesn't work in my incident review

gwen — Fri, 17 Nov 2023 13:06:12 GMT

hello,

index=windows_srv EventCode=20005 | stats count by host | search count >= 1 | eval server_impacted = host, tentative_number = count | table server_impacted, tentative_number

and im using $server_impacted$ and $tentative_number$ in my correlation search.

then i see in tittle on my incident review : my message on $server_impacted$ instead my message on windowsservername

Re: correlation search variable doesn't work in my incident review

gcusello — Fri, 17 Nov 2023 12:59:58 GMT

Hi @gwen ,

let me understand: what are $server_impacted$ and $tentative_number$?

are they tokens to pass in a drilldown or what else?

Ciao.

Giuseppe

Re: correlation search variable doesn't work in my incident review

gwen — Tue, 21 Nov 2023 14:59:38 GMT

I thank you but I can not share much information because confidential.
It’s better to close the post.
Thanks for your help.
Excuse me for being upset.

Re: correlation search variable doesn't work in my incident review

gcusello — Tue, 21 Nov 2023 15:02:47 GMT

Hi @gwen ,

as you like, but masking the information I don't think that you reveal your confidential information.

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉