Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Single value module question
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is what i'm looking to do and i can't figure it out. I want a single value module to green up once a certain event shows up and go red when a different event shows up and instead of the module displaying the number of events, i want it to show the src address that is in the event. Any suggestions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up.
The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range":
eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe")
In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search.
...
<module name="SingleValue">
<param name="field">src_ip</param>
<param name="classField">range</param>
</module>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked like a charm. Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is accomplished using both search and SingleValue. In search you want to set the "range" field based on which event shows up.
The Search will lookup for either event and grab the first one. Eval is used to determine the value of "range":
eventA OR eventB | head 1 | eval range=if(eventA, "low", "severe")
In SingleValue the "field" param is the display field so we will set that to the source address. classField "range" adds an additional css class to SingleValue (low=green, red=severe). These values were set based on the above search.
...
<module name="SingleValue">
<param name="field">src_ip</param>
<param name="classField">range</param>
</module>
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Automating Threat Operations and Threat Hunting with Recorded Future
Keep the Learning Going with the New Best of .conf Hub
Splunk Community Badges!
