topic Search for an adjacent IP address in Splunk Search

Search for an adjacent IP address

logginz85 — Mon, 16 Nov 2020 13:12:42 GMT

Hi.

I have an alert that'll tell me if a host is down, and it runs for both Active and Standby hosts.

The issue is that when the standby host hasn't received a log, I'd like to run a search to see if the active host has received a log in the last 24 hours, and if so to ignore it.

I can run a search for all IPs, but what I cant seem to do is see if 198.0.0.2 is down, to check for 198.0.0.1 (the Active is always -1 from Standby)

I thought something like this might work, but no.

index=* host=*
[search index="*" host=198.0.0.2

Re: Search for an adjacent IP address

richgalloway — Mon, 16 Nov 2020 15:47:38 GMT

Splunk has a hard time finding things that aren't there. In this case, if host 198.0.0.2 isn't found then there will be no host field from which to extract sub-fields and, so, no newhost field.

If you run the subsearch by itself with "| format" added then you'll see what it returns to the main search.

Re: Search for an adjacent IP address

logginz85 — Mon, 16 Nov 2020 16:34:08 GMT

Hi, that makes sense, and |format helped me realise it wasn't pulling through right.

That lead me onto this.

index="*" host = *
| eval standbyhost = "198.0.0.2"
| rex field=standbyhost "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)"
| eval Host2 = (Host-1)
| eval newhost= Net. "." .Host2
| where host = newhost

I create a new field "standbyhost" that is the value of the standby host I already know. I apply this to all results.
Then I do maths to lower this IP by 1, and create the new field newhost.

Now every rsult has their host as their own host IP, but the field newvalue of the target I'm looking for.

Then its just a where host=newhost to find it.

Seeing as this will actually pull the value of standbyhost from a field in an alert, I think this'll work.

Re: Search for an adjacent IP address

richgalloway — Mon, 16 Nov 2020 17:56:48 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.