How to add device pair requirement to SPL?

[danielbb]

We have this search which works fine:

| inputlookup critical_cyber_devices.csv 
| join SplunkHost type=outer 
    [| metadata index=<index1> index=<index2> type=hosts 
    | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
    | eval actualhourslag=(now()-'Last Event')/60/60 ] 
| fieldformat "Last Event"=strftime('Last Event', "%c") 
| where actualhourslag>HoursLag 
| stats sum(Count) by SplunkHost
| rename sum(Count) as total
| where total < 10

It detects the devices which are not reporting data.

However, these devices are paired up, which means that as long as one of them reports data, we are all good.
How can we add this pairing requirement to the search?

[jawaharas]

Is there any field in 'inputlookup critical_cyber_devices.csv' lookup table that indicates about paired devices?

[danielbb]

Oh yeah @jawaharas - we have that.

[danielbb]

I added a lookup command at the end -

 | inputlookup critical_cyber_devices.csv 
 | join SplunkHost type=outer 
     [| metadata index=<index1> index=<index2> type=hosts 
     | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
     | eval actualhourslag=(now()-'Last Event')/60/60 ] 
 | fieldformat "Last Event"=strftime('Last Event', "%c") 
 | where actualhourslag>HoursLag 
 | stats sum(Count) by SplunkHost
 | rename sum(Count) as total
 | where total < 10
 | lookup critical_cyber_devices.csv  SplunkHost OUTPUT PairGroup

This produces an output of the SplunkHost followed by the PairGroup name. So, now, I need to alert only when there are two lines with the same PairGroup value.

[danielbb]

Something like this -

| search PairGroup!=""
| stats count() by PairGroup
| rename count(total) as Total
| search Total > 1