I want to setup a search that determines which countries have connected to my network over the past "x" hours, and then I want to highlight the table line if a specified country shows up. Here is the search I have so far:
sourcetype=cisco:asa dest_ip="X.X.0.0/16" NOT "Failover primary closed" | iplocation src_ip | stats count by Country | sort - count | dedup Country | highlight "CountryName"
I get the table, but the highlighting never happens even if I pick a country that shows up in the table. Last, I would like for this search to trigger an alert and email the alert if the specified country is in the table.
Here is another thought. What is I wrote out the results of the iplookup command to a lookup file via the outputlookup command. Next, if I do a search against that lookup file with the lookup command, would I then be able to use the highlight command?
Despite being in the documentation (which I've never noticed before) it does not appear to work at all. I just tried a very simple case that matches the sample search and... nothing. Sounds like you should report this as a bug.
@wrangler2x highlight works with Raw Events when you display the same as list. It will not work with Transforming command like stats, table etc.
Just to mention it, there's no need to
| dedup Country, cause after a
stats by Country there won't be any duplicates for that field ever. To setup an alert, add a filter for your relevant countries (like
| where Country="yourcountry"), and then just have the alert fire when there is more than 0 results. 🙂