Splunk Search

How to add device pair requirement to SPL?

Motivator

We have this search which works fine:

| inputlookup critical_cyber_devices.csv 
| join SplunkHost type=outer 
    [| metadata index=<index1> index=<index2> type=hosts 
    | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
    | eval actualhourslag=(now()-'Last Event')/60/60 ] 
| fieldformat "Last Event"=strftime('Last Event', "%c") 
| where actualhourslag>HoursLag 
| stats sum(Count) by SplunkHost
| rename sum(Count) as total
| where total < 10

It detects the devices which are not reporting data.

However, these devices are paired up, which means that as long as one of them reports data, we are all good.
How can we add this pairing requirement to the search?

0 Karma

Motivator

Is there any field in 'inputlookup criticalcyberdevices.csv' lookup table that indicates about paired devices?

0 Karma

Motivator

Oh yeah @jawaharas - we have that.

0 Karma

Motivator

I added a lookup command at the end -

 | inputlookup critical_cyber_devices.csv 
 | join SplunkHost type=outer 
     [| metadata index=<index1> index=<index2> type=hosts 
     | rename totalCount as Count, host as SplunkHost, lastTime as "Last Event" 
     | eval actualhourslag=(now()-'Last Event')/60/60 ] 
 | fieldformat "Last Event"=strftime('Last Event', "%c") 
 | where actualhourslag>HoursLag 
 | stats sum(Count) by SplunkHost
 | rename sum(Count) as total
 | where total < 10
 | lookup critical_cyber_devices.csv  SplunkHost OUTPUT PairGroup

This produces an output of the SplunkHost followed by the PairGroup name. So, now, I need to alert only when there are two lines with the same PairGroup value.

0 Karma

Motivator

Something like this -

| search PairGroup!=""
| stats count() by PairGroup
| rename count(total) as Total
| search Total > 1
0 Karma