Splunk Search

How to add device pair requirement to SPL?

danielbb
Motivator

We have this search which works fine:

| inputlookup critical_cyber_devices.csv 
| join SplunkHost type=outer 
    [| metadata index=<index1> index=<index2> type=hosts 
    | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
    | eval actualhourslag=(now()-'Last Event')/60/60 ] 
| fieldformat "Last Event"=strftime('Last Event', "%c") 
| where actualhourslag>HoursLag 
| stats sum(Count) by SplunkHost
| rename sum(Count) as total
| where total < 10

It detects the devices which are not reporting data.

However, these devices are paired up, which means that as long as one of them reports data, we are all good.
How can we add this pairing requirement to the search?

0 Karma

jawaharas
Motivator

Is there any field in 'inputlookup critical_cyber_devices.csv' lookup table that indicates about paired devices?

0 Karma

danielbb
Motivator

Oh yeah @jawaharas - we have that.

0 Karma

danielbb
Motivator

I added a lookup command at the end -

 | inputlookup critical_cyber_devices.csv 
 | join SplunkHost type=outer 
     [| metadata index=<index1> index=<index2> type=hosts 
     | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
     | eval actualhourslag=(now()-'Last Event')/60/60 ] 
 | fieldformat "Last Event"=strftime('Last Event', "%c") 
 | where actualhourslag>HoursLag 
 | stats sum(Count) by SplunkHost
 | rename sum(Count) as total
 | where total < 10
 | lookup critical_cyber_devices.csv  SplunkHost OUTPUT PairGroup

This produces an output of the SplunkHost followed by the PairGroup name. So, now, I need to alert only when there are two lines with the same PairGroup value.

0 Karma

danielbb
Motivator

Something like this -

| search PairGroup!=""
| stats count() by PairGroup
| rename count(total) as Total
| search Total > 1
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...