Splunk Enterprise Security

Variable substitution not working in correlation search?

tromero3
Path Finder

I have a correlation search for detecting when host stops sending logs. I enabled the search and set the title as below but when I receive the notables, my results show the hostname of the search head as the $host$ instead of the actual host who stopped sending logs. When I expand the notable, it does show the correct host under the "Additional Fields" section, just not in the title of the notable. The $Latest_Time$ doesn't work either, I'm not sure if it's possible to even use that or what I would have to put so it shows the Latest_Time / Last Time Reported field. Any help would be greatly appreciated!

Title of correlation search:
"Host $host$ stopped sending logs since $Latest_Time$"

Query:
| metadata type=hosts index=*| where relative_time(now(), "-1d") > lastTime AND lastTime > relative_time(now(), "-90d") | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup asset_lookup_by_str nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit |rename Latest_Time AS "Last Time Reported"

0 Karma
1 Solution

tromero3
Path Finder

So it looks like the issue was that I needed to use $orig_host$ to get the original host from the actual events. $host$ was just getting the search head hostname (maybe due to the metadata command?).

View solution in original post

0 Karma

neerajs_81
Builder

@tromero3   I ran into the very same issue with $host$ not working . Pls advise how did you come up with $orig_host$ field ?

0 Karma

tromero3
Path Finder

So it looks like the issue was that I needed to use $orig_host$ to get the original host from the actual events. $host$ was just getting the search head hostname (maybe due to the metadata command?).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not sure why $host$ is not working, but $Latest_Time$ doesn't work because there is no such field. It's renamed to $Last Time Reported$.

---
If this reply helps you, Karma would be appreciated.
0 Karma

tromero3
Path Finder

Okay I changed the $Latest_Time$ to $Last Time Reported$ and that part is now fixed. Thank you!

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...