Splunk Enterprise Security

Variable substitution not working in correlation search?

tromero3
Path Finder

I have a correlation search for detecting when host stops sending logs. I enabled the search and set the title as below but when I receive the notables, my results show the hostname of the search head as the $host$ instead of the actual host who stopped sending logs. When I expand the notable, it does show the correct host under the "Additional Fields" section, just not in the title of the notable. The $Latest_Time$ doesn't work either, I'm not sure if it's possible to even use that or what I would have to put so it shows the Latest_Time / Last Time Reported field. Any help would be greatly appreciated!

Title of correlation search:
"Host $host$ stopped sending logs since $Latest_Time$"

Query:
| metadata type=hosts index=*| where relative_time(now(), "-1d") > lastTime AND lastTime > relative_time(now(), "-90d") | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup asset_lookup_by_str nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit |rename Latest_Time AS "Last Time Reported"

0 Karma
1 Solution

tromero3
Path Finder

So it looks like the issue was that I needed to use $orig_host$ to get the original host from the actual events. $host$ was just getting the search head hostname (maybe due to the metadata command?).

View solution in original post

0 Karma

tromero3
Path Finder

So it looks like the issue was that I needed to use $orig_host$ to get the original host from the actual events. $host$ was just getting the search head hostname (maybe due to the metadata command?).

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not sure why $host$ is not working, but $Latest_Time$ doesn't work because there is no such field. It's renamed to $Last Time Reported$.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

tromero3
Path Finder

Okay I changed the $Latest_Time$ to $Last Time Reported$ and that part is now fixed. Thank you!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!