Security

How to compare two values on same row

Tomers
Engager

Hey,

I have a rule, that report to me each time source stop sending logs to my splunk.

I try to make an exception, that when a specific source from a specific host will stop sending logs, it wont trigger an alert.

for example:

i will get alerts from

host=* source=*

but not when its

host=windows31 source=application

 

  • Is it possible to do that? because i try to work on it for a few days already.

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Tomers,

I could help you better if you could share your search, also because it isn't clear for me how your rule works.

Anyway, you could add the second condition to your search:

index=your_index NOT(host=windows31 source=application)
| ...

if you have many of these conditions, you could put them in a lookup (called e.g. exceptions.csv  with two columns called host and source) and use the lookup to filter your results.

index=your_index NOT [ | inputlookup exceptions.csv | fields host source ]
| ...

 Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Tomers,

I could help you better if you could share your search, also because it isn't clear for me how your rule works.

Anyway, you could add the second condition to your search:

index=your_index NOT(host=windows31 source=application)
| ...

if you have many of these conditions, you could put them in a lookup (called e.g. exceptions.csv  with two columns called host and source) and use the lookup to filter your results.

index=your_index NOT [ | inputlookup exceptions.csv | fields host source ]
| ...

 Ciao.

Giuseppe

0 Karma

Tomers
Engager

Thank you! It does work now

for some reason that is the only thing i didnt think of.

 

FYI-

My search is(i only added the condition lines here)-

|tstats latest(_time) as _time where index=* by sourcetype host

|where _time<relative_time(now(), "-1h")

|fields sourcetype host _time

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Tomers,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...