topic Re: Raise alert for specific computers in Alerting

Raise alert for specific computers

wnyricsplunk — Tue, 14 Jul 2020 12:31:09 GMT

I would like to trigger an Alert when event 1074 (Windows Shutdown) is raised but only for specific computers. I have a group of about 50 servers and I would like to know if they shut down but I don't care about workstations in general. Since all events currently go to the same index I need a way to only trigger the alert when one of the servers raises the event. Short of a huge OR statement in my search, is there a way to do something like this?

Re: Raise alert for specific computers

richgalloway — Tue, 14 Jul 2020 12:58:22 GMT

Unless there is some other unique attribute of the 50 servers, you have to use a bunch of ORs or a lookup file.

Re: Raise alert for specific computers

wnyricsplunk — Tue, 14 Jul 2020 13:07:45 GMT

Thanks. I will try using a lookup.

Re: Raise alert for specific computers

mattymo — Tue, 14 Jul 2020 13:15:57 GMT

Hi!

You an create a macro to store the hosts that will expand into a filter, as you suggested, or you can use a lookup table that you pull into the search to use as a filter.

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesearchmacros

https://community.splunk.com/t5/Splunk-Search/How-to-write-a-search-to-filter-hosts-by-lookup-table-and-show/td-p/223237