Monitoring Splunk

List correlation searches which did not trigger a notable in past X days

fedejko
Explorer

Hi,

I have a list of all notable events which triggered in X days using this SPL:

 

index=notable search_name="*Rule" orig_action_name=notable
| stats count by search_name

 

 

Using this query I can see the list of my all rules which are enabled to trigger notables: 

 

| rest /services/saved/searches
| search title="*Rule" action.notable=1
| table title

 

Obviusly, the second search returns much larger list. I'd like to correlate those two searches to find out which of all the rules did not dispatch a notable in past X days.

Any ideas on how to achieve this?

Labels (2)
0 Karma

fedejko
Explorer

Thanks, I was thinking about the join, too, but finally I came up with something like this:

| rest /services/saved/searches
| search title="*Rule" action.notable=1
| rename title as rule_name
| search NOT
[ search index=notable search_name="*Rule" orig_action_name=notable
| stats count by search_name
| rename search_name as rule_name
| table rule_name ]
| table rule_name ]

I thought it would be faster than joins.

0 Karma

ccloutier_splun
Splunk Employee
Splunk Employee

@fedejko You should be able to join the two sets together, like this, for example (reusing your two queries):

| rest /services/saved/searches
| search title="*Rule" action.notable=1
| fields title
| eval has_triggered_notables = "false"
| join type=outer title [
   search index=notable search_name="*Rule" orig_action_name=notable
   | stats count by search_name
   | fields - count
   | rename search_name as title
   | eval has_triggered_notables = "true"
]

That adds a field has_triggered_notables which will indicate if a rule has triggered notable and you can then filter out the results to your liking, for example, to show only the rules which did trigger notables:

| where has_triggered_notables = "true"
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...