Splunk Search

Reuse search query, but conditionally

bitnoise
Explorer

Hi,

I have a 'complex' (for me at least) question.  What I want to achieve is the following:

1) 

index=abc msg="*firewall off*" |table _time,hostname,msg

>this will give me, for example:
hostname = machine1
msg = "the firewall has been turned off"
>> I want to be triggered if someone turns off the firewall

Now, the actual issue I have now is the following:  A few seconds before this event, I might get a "system update event" that updates the firewall (agent update), which is OK, and I do NOT want this event.
I would need to combine both queries into 1 alert.  
2) 

index=abc hostname=machine1 NOT msg="*system updated*"

I want to see the result of 1, but only if it was not preceeded by 2.

I hope this makes sense.

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Technically the search msg="*firewall off*" will not match the firewall has been turned off

but assuming that's understood, then this may work for you

index=abc msg="*firewall off*" OR msg="*system updated*"
| streamstats time_window=30s dc(msg) as msgTypes count by hostname 
| where (match(msg, "firewall off") AND count=1) OR (count>1 AND msgTypes=1)
| table _time, hostname, msg

It uses streamstats to combine events within a 30 second time window - set that to your expected range.

The where clause filters only those events where it just contains firewall off OR there are multiple firewall off messages, but no system updated message.

View solution in original post

bitnoise
Explorer

Cool, never saw that streamstats thingy, I'll test it and let you know 🙂

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Technically the search msg="*firewall off*" will not match the firewall has been turned off

but assuming that's understood, then this may work for you

index=abc msg="*firewall off*" OR msg="*system updated*"
| streamstats time_window=30s dc(msg) as msgTypes count by hostname 
| where (match(msg, "firewall off") AND count=1) OR (count>1 AND msgTypes=1)
| table _time, hostname, msg

It uses streamstats to combine events within a 30 second time window - set that to your expected range.

The where clause filters only those events where it just contains firewall off OR there are multiple firewall off messages, but no system updated message.

bitnoise
Explorer

I was fighting with the query, as it kept on giving me results, but seems I overlooked the fact that the "off" trigger happend twice and the other only once 🙂 

 

Great! Thanks a lot

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...