How to compare two values on same row

[Tomers]

Hey,

I have a rule, that report to me each time source stop sending logs to my splunk.

I try to make an exception, that when a specific source from a specific host will stop sending logs, it wont trigger an alert.

for example:

i will get alerts from

host=* source=*

but not when its

host=windows31 source=application

• Is it possible to do that? because i try to work on it for a few days already.

[gcusello · Accepted solution]

Hi @Tomers,

I could help you better if you could share your search, also because it isn't clear for me how your rule works.

Anyway, you could add the second condition to your search:

index=your_index NOT(host=windows31 source=application)
| ...

if you have many of these conditions, you could put them in a lookup (called e.g. exceptions.csv  with two columns called host and source) and use the lookup to filter your results.

index=your_index NOT [ | inputlookup exceptions.csv | fields host source ]
| ...

 Ciao.

Giuseppe

[Tomers]

Thank you! It does work now

for some reason that is the only thing i didnt think of.

FYI-

My search is(i only added the condition lines here)-

|tstats latest(_time) as _time where index=* by sourcetype host

|where _time<relative_time(now(), "-1h")

|fields sourcetype host _time

[gcusello]

Hi @Tomers,

good for you, see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉