topic Re: How to add device pair requirement to SPL? in Splunk Search

How to add device pair requirement to SPL?

danielbb — Wed, 31 Jul 2019 19:35:05 GMT

We have this search which works fine:

| inputlookup critical_cyber_devices.csv 
| join SplunkHost type=outer 
    [| metadata index=<index1> index=<index2> type=hosts 
    | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
    | eval actualhourslag=(now()-'Last Event')/60/60 ] 
| fieldformat "Last Event"=strftime('Last Event', "%c") 
| where actualhourslag>HoursLag 
| stats sum(Count) by SplunkHost
| rename sum(Count) as total
| where total < 10

It detects the devices which are not reporting data.

However, these devices are paired up, which means that as long as one of them reports data, we are all good.
How can we add this pairing requirement to the search?

Re: How to add device pair requirement to SPL?

jawaharas — Wed, 30 Sep 2020 01:32:49 GMT

Is there any field in 'inputlookup critical_cyber_devices.csv' lookup table that indicates about paired devices?

Re: How to add device pair requirement to SPL?

danielbb — Thu, 01 Aug 2019 12:35:45 GMT

Oh yeah @jawaharas - we have that.

Re: How to add device pair requirement to SPL?

danielbb — Thu, 01 Aug 2019 20:57:29 GMT

I added a lookup command at the end -

 | inputlookup critical_cyber_devices.csv 
 | join SplunkHost type=outer 
     [| metadata index=<index1> index=<index2> type=hosts 
     | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
     | eval actualhourslag=(now()-'Last Event')/60/60 ] 
 | fieldformat "Last Event"=strftime('Last Event', "%c") 
 | where actualhourslag>HoursLag 
 | stats sum(Count) by SplunkHost
 | rename sum(Count) as total
 | where total < 10
 | lookup critical_cyber_devices.csv  SplunkHost OUTPUT PairGroup

This produces an output of the SplunkHost followed by the PairGroup name. So, now, I need to alert only when there are two lines with the same PairGroup value.

Re: How to add device pair requirement to SPL?

danielbb — Thu, 01 Aug 2019 21:23:37 GMT

Something like this -

| search PairGroup!=""
| stats count() by PairGroup
| rename count(total) as Total
| search Total > 1