Splunk Search

What am I doing wrong with the aggregate macro syntax in my correlation search to create notable events?

New Member

Search I am trying to use:

index="wineventlog" (EventCode=4656 Accesses=DELETE) OR EventCode=1102 OR EventCode=4670 OR EventCode=564  |  `get_date(now())` | `aggregate("Endpoint - FIM - Rule".date.Object_Name)` |  eval _time=now() | eval orig_raw=_raw | fields - _raw

If I leave in the macro

`aggregate("Endpoint - FIM - Rule".date.Object_Name)` 

I receive an error stating aggregate(1), which I haven't been able to find any information on what my syntax issue is.

If I take out the aggregate macro, the search will bring back results.

Two items that i need help with:

  1. What am I doing wrong with the aggregate macro syntax?
  2. Even though the search brings back results, notable events are not created.

Thank you!

0 Karma


Try changing the double quotes around your fieldname to single quotes.... 'Endpoint - FIM - Rule' .Or try defining a variable and passing that variable to the macro. | eval agg_input='Endpoint - FIM - Rule'.date.Object_Name | aggregate(agg_input) Not sure if either will work, but worth a try.

0 Karma

New Member

Thank you for you help, but I tried both options and still received the same error.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!