Splunk Search

Add another condition Help

dave0970
Engager

Hello, please help create a search add another condition to fire this alert if there are no results

Here is the splunk output if there is no result

localhost.localdomain: timed out, nothing received

***Request timed out

index=timevariance | multikv | where isint(when) | rex field=remote "(?*\w*)" | eval abs_offset=abs(offset) | search abs_offset>=100000 | append [ search index=_* ERROR sourcetype=splunkd component=ExecProcessor NOT admon message="ntp" | stats count values(message) as _raw by host ] | eval alert_contact=case(host LIKE "irprinfspl%", "Security", host LIKE "deprinfspl%", "Security", host LIKE "%", "SysEng") | eval alert_description="Time Out of Sync. Use NOC portal to sync up time & restart ntp service. Any other issues contact alert_contact." | table _time, host, alert_contact, alert_description, _raw | search host!=splnod host!="pvtemplate"

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@dave0970,

Are you looking for something similar?

index=timevariance | multikv | where isint(when) | rex field=remote "(?*\w)" | eval abs_offset=abs(offset) | search abs_offset>=100000 | append [ search index=_* ERROR sourcetype=splunkd component=ExecProcessor NOT admon message="ntp" | stats count values(message) as _raw by host ] | eval alert_contact=case(host LIKE "irprinfspl%", "Security", host LIKE "deprinfspl%", "Security", host LIKE "%", "SysEng") | eval alert_description="Time Out of Sync. Use NOC portal to sync up time & restart ntp service. Any other issues contact alert_contact." | table _time, host, alert_contact, alert_description, _raw | search (host!=splnod  AND 
 host!="pvtemplate") OR ("nothing received")
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

0 Karma

renjith_nair
Legend

@dave0970,

Are you looking for something similar?

index=timevariance | multikv | where isint(when) | rex field=remote "(?*\w)" | eval abs_offset=abs(offset) | search abs_offset>=100000 | append [ search index=_* ERROR sourcetype=splunkd component=ExecProcessor NOT admon message="ntp" | stats count values(message) as _raw by host ] | eval alert_contact=case(host LIKE "irprinfspl%", "Security", host LIKE "deprinfspl%", "Security", host LIKE "%", "SysEng") | eval alert_description="Time Out of Sync. Use NOC portal to sync up time & restart ntp service. Any other issues contact alert_contact." | table _time, host, alert_contact, alert_description, _raw | search (host!=splnod  AND 
 host!="pvtemplate") OR ("nothing received")
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dave0970
Engager

Hi Renjith,

Thank you! I will test it out. Thanks

0 Karma
Get Updates on the Splunk Community!

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...