Splunk Search

How to add device pair requirement to SPL?

danielbb
Motivator

We have this search which works fine:

| inputlookup critical_cyber_devices.csv 
| join SplunkHost type=outer 
    [| metadata index=<index1> index=<index2> type=hosts 
    | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
    | eval actualhourslag=(now()-'Last Event')/60/60 ] 
| fieldformat "Last Event"=strftime('Last Event', "%c") 
| where actualhourslag>HoursLag 
| stats sum(Count) by SplunkHost
| rename sum(Count) as total
| where total < 10

It detects the devices which are not reporting data.

However, these devices are paired up, which means that as long as one of them reports data, we are all good.
How can we add this pairing requirement to the search?

0 Karma

jawaharas
Motivator

Is there any field in 'inputlookup critical_cyber_devices.csv' lookup table that indicates about paired devices?

0 Karma

danielbb
Motivator

Oh yeah @jawaharas - we have that.

0 Karma

danielbb
Motivator

I added a lookup command at the end -

 | inputlookup critical_cyber_devices.csv 
 | join SplunkHost type=outer 
     [| metadata index=<index1> index=<index2> type=hosts 
     | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
     | eval actualhourslag=(now()-'Last Event')/60/60 ] 
 | fieldformat "Last Event"=strftime('Last Event', "%c") 
 | where actualhourslag>HoursLag 
 | stats sum(Count) by SplunkHost
 | rename sum(Count) as total
 | where total < 10
 | lookup critical_cyber_devices.csv  SplunkHost OUTPUT PairGroup

This produces an output of the SplunkHost followed by the PairGroup name. So, now, I need to alert only when there are two lines with the same PairGroup value.

0 Karma

danielbb
Motivator

Something like this -

| search PairGroup!=""
| stats count() by PairGroup
| rename count(total) as Total
| search Total > 1
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...