Splunk Enterprise Security

Variable substitution not working in correlation search?

tromero3
Path Finder

I have a correlation search for detecting when host stops sending logs. I enabled the search and set the title as below but when I receive the notables, my results show the hostname of the search head as the $host$ instead of the actual host who stopped sending logs. When I expand the notable, it does show the correct host under the "Additional Fields" section, just not in the title of the notable. The $Latest_Time$ doesn't work either, I'm not sure if it's possible to even use that or what I would have to put so it shows the Latest_Time / Last Time Reported field. Any help would be greatly appreciated!

Title of correlation search:
"Host $host$ stopped sending logs since $Latest_Time$"

Query:
| metadata type=hosts index=*| where relative_time(now(), "-1d") > lastTime AND lastTime > relative_time(now(), "-90d") | convert ctime(lastTime) as Latest_Time | sort -lastTime | table host,Latest_Time | lookup asset_lookup_by_str nt_host AS host OUTPUTNEW priority AS priority,bunit AS bunit |rename Latest_Time AS "Last Time Reported"

0 Karma
1 Solution

tromero3
Path Finder

So it looks like the issue was that I needed to use $orig_host$ to get the original host from the actual events. $host$ was just getting the search head hostname (maybe due to the metadata command?).

View solution in original post

0 Karma

neerajs_81
Builder

@tromero3   I ran into the very same issue with $host$ not working . Pls advise how did you come up with $orig_host$ field ?

0 Karma

tromero3
Path Finder

So it looks like the issue was that I needed to use $orig_host$ to get the original host from the actual events. $host$ was just getting the search head hostname (maybe due to the metadata command?).

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not sure why $host$ is not working, but $Latest_Time$ doesn't work because there is no such field. It's renamed to $Last Time Reported$.

---
If this reply helps you, Karma would be appreciated.
0 Karma

tromero3
Path Finder

Okay I changed the $Latest_Time$ to $Last Time Reported$ and that part is now fixed. Thank you!

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...