Custom Trigger Condition for alert if not specific destination IP

[jrosecbt]

I am attempting to create a custom trigger condition for the alert below that will only trigger if the dest_ip does not equal a specific IP.

Currently attempting the trigger alert when custom with: search NOT dest_ip=xxx.xxx.xxx.xxx
and have also tried: search dest_ip!=xxx.xxx.xxx.xxx
and I am still seeing email alerts being sent for alerts in which the destination ip is the one that should be omitted.

index=someindex [search index=someindex retro_disposition=3 OR disposition=3 latest=now earliest=-3m | fields sha256] | eval time=strftime(event_sec,"%m/%d/%y %H:%M:%S") | table _time time src_ip src_port dest_ip dest_port file_type file_name file_size retro_disposition disposition sha256 sensor uri | sort sha256 -_time

Any help is greatly appreciated,
Jimmy

[lfedak_splunk]

Hey @jrosecbt, if @DalJeanis solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

[DalJeanis]

When debugging issues like this, one thing you have to check for is multivalue fields. If there are two dest_ip values, then one of them will always NOT match any given value. Also, be sure to put quotes around literals when appropriate.

So, start with finding an exact moment that you have an event that sets off your alert, then run this to see which tests work for you.

 earliest=something latest=something
 | eval test1=if(match(dest_ip,"1\.2\.3\.4"),"yes","no")
 | eval test2=if(like(dest_ip,"1.2.3.4"),"yes","no")
 | eval test3=if(dest_ip="1.2.3.4","yes","no")
 | eval test4=if(dest_ip!="1.2.3.4","yes","no")
 | table _time dest_ip test*   

[jrosecbt]

I have run the suggestion above and we do see at times multiple entries for dest_ip. I am having trouble understanding the syntax for the custom trigger condition and am having trouble finding much documentation on its use. Are you aware of any documentation that explains the trigger condition more than a few greater than or less than count examples.

Thank you,
Jimmy