Drill Down Search

[kjain041523]

drilldown search in splunk notable is not capturing the original host which is mentioned in correlation search and generating 0 results how to resolve this issue.

Correlation Search:

index=wineventlog host IN (AZR01PSQL19CL01, AZR01PSQL19CL02)
(EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480)
| eval usecase=" SQL 2019 Cluster Failover"
| stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message
| eval severity=case (
EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium"
)
| convert ctime(firstTime) ctime(lastTime)

Drilldown search
index=wineventlog host=$Host$
(EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480)
| eval usecase=" SQL 2019 Cluster Failover"
| stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message
| eval severity=case (
EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium"
)
| convert ctime(firstTime) ctime(lastTime)

when checking the drilldown search from splunk notable, i'm not getting any results and showing below code
index=wineventlog host=aws01psplksh01
(EventCode=1069 OR EventCode=1205 OR EventCode=1641 OR EventCode=1480)
| eval usecase=" SQL 2019 Cluster Failover"
| stats count min(_time) as firstTime max(_time) as lastTime by host EventCode Message
| eval severity=case (
EventCode=1205 OR EventCode=1480, "critical", EventCode=1069, "high", EventCode=1641, "medium"
)
| convert ctime(firstTime) ctime(lastTime)


How to resolve this issue.
TIA

[gcusello]

Hi @kjain041523 ,

you must use as token the same field name of the Detection search, in yur case $host$ and not $Host$.

Ciao.

Giuseppe

[richgalloway]

This probably should go in the Enterprise Security channel, but it looks like the drilldown search is using token $Host$, which doesn't exist.  Try $host$.