Security

How to compare two values on same row

Tomers
Engager

Hey,

I have a rule, that report to me each time source stop sending logs to my splunk.

I try to make an exception, that when a specific source from a specific host will stop sending logs, it wont trigger an alert.

for example:

i will get alerts from

host=* source=*

but not when its

host=windows31 source=application

 

  • Is it possible to do that? because i try to work on it for a few days already.

 

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Tomers,

I could help you better if you could share your search, also because it isn't clear for me how your rule works.

Anyway, you could add the second condition to your search:

index=your_index NOT(host=windows31 source=application)
| ...

if you have many of these conditions, you could put them in a lookup (called e.g. exceptions.csv  with two columns called host and source) and use the lookup to filter your results.

index=your_index NOT [ | inputlookup exceptions.csv | fields host source ]
| ...

 Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Tomers,

I could help you better if you could share your search, also because it isn't clear for me how your rule works.

Anyway, you could add the second condition to your search:

index=your_index NOT(host=windows31 source=application)
| ...

if you have many of these conditions, you could put them in a lookup (called e.g. exceptions.csv  with two columns called host and source) and use the lookup to filter your results.

index=your_index NOT [ | inputlookup exceptions.csv | fields host source ]
| ...

 Ciao.

Giuseppe

0 Karma

Tomers
Engager

Thank you! It does work now

for some reason that is the only thing i didnt think of.

 

FYI-

My search is(i only added the condition lines here)-

|tstats latest(_time) as _time where index=* by sourcetype host

|where _time<relative_time(now(), "-1h")

|fields sourcetype host _time

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Tomers,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...