topic Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes in Splunk Search

How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

SplunkLunk — Wed, 13 May 2020 16:17:28 GMT

Greetings,

I want to report on any Linux system that hasn't had an event in /var* for 30 minutes. I was going to use Source="/var/log/messages" but our admins told me that they want anything below /var to be reported on. I tried using the metadata command but that didn't get me anywhere. Does anyone have any suggestions? Thanks.

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

to4kawa — Wed, 13 May 2020 19:23:18 GMT

| tstats count as Counts where source="/var/*" by source host
| inputlookup append=t your_host.csv
| stats values(Counts) as count by source host
| fillnull count
| where count=0

your_host.csv:

host,source
A,/var/log/messages
A,/var/log/
B,/var/log/messages
B,....

Field name is case sensitive. Source is wrong.
I don't know what's gold. so both source and host is aggregated.

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

SplunkLunk — Wed, 13 May 2020 20:04:53 GMT

Thanks. Will a wildcard in the CSV file work? Could the source be /var/log/*

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

to4kawa — Wed, 13 May 2020 20:37:36 GMT

between no2 and no3,

| rex mode=sed field=source "s/\/\w+/\/*/3"

to force them to match.

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

SplunkLunk — Wed, 30 Sep 2020 05:24:29 GMT

Thanks but I must be doing something wrong. I've added a lookup file with the format:

host, source
host1, /var/log*
host2, /var/log*

I've done your search:

| tstats count as Counts where index=[my index] source="/var/log*" by host
| inputlookup append=t May_Linux_Hosts.csv
| rex mode=sed field=source "s/\/\w+/\/*/3"
| stats values(Counts) as count by source host
| fillnull count
| where count=0

And the output I get is:

source, host, count
/var/log/, host1,0
/var/log/, host2,0
.
.
.

So it's like it's not treating the * as a wildcard. Any idea what I'm doing wrong?

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

to4kawa — Wed, 13 May 2020 21:10:04 GMT

your comment: /var/log/* now: var/log*

| rex mode=sed field=source "s/\/\w+/\/*/3"
→ | rex mode=sed field=source "s/(\/var\/log).*/\1*/"

We use regular expressions, so even the slightest difference won't work.

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

SplunkLunk — Wed, 30 Sep 2020 05:24:40 GMT

Thanks for the help. Still producing same output with the following search. I guess I don't know enough about regex to troubleshoot. I was even going to regex101.com to test without any luck:

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

SplunkLunk — Thu, 14 May 2020 03:24:31 GMT

It jacked the formatting of the rex line up. I cut and paste exactly like you showed, but it doesn't look that way in my response.

Re: How Report Any Host That Hasn't Had an Event From Source="/var*" in "X" Minutes

to4kawa — Thu, 14 May 2020 05:07:41 GMT

check your source value after rex