Splunk Search
Highlighted

What am I doing wrong with the aggregate macro syntax in my correlation search to create notable events?

New Member

Search I am trying to use:

index="wineventlog" (EventCode=4656 Accesses=DELETE) OR EventCode=1102 OR EventCode=4670 OR EventCode=564  |  `get_date(now())` | `aggregate("Endpoint - FIM - Rule".date.Object_Name)` |  eval _time=now() | eval orig_raw=_raw | fields - _raw

If I leave in the macro

`aggregate("Endpoint - FIM - Rule".date.Object_Name)` 

I receive an error stating aggregate(1), which I haven't been able to find any information on what my syntax issue is.

If I take out the aggregate macro, the search will bring back results.

Two items that i need help with:

  1. What am I doing wrong with the aggregate macro syntax?
  2. Even though the search brings back results, notable events are not created.

Thank you!

0 Karma
Highlighted

Re: What am I doing wrong with the aggregate macro syntax in my correlation search to create notable events?

Legend

Try changing the double quotes around your fieldname to single quotes.... 'Endpoint - FIM - Rule' .Or try defining a variable and passing that variable to the macro. | eval agg_input='Endpoint - FIM - Rule'.date.Object_Name | aggregate(agg_input) Not sure if either will work, but worth a try.

0 Karma
Highlighted

Re: What am I doing wrong with the aggregate macro syntax in my correlation search to create notable events?

New Member

Thank you for you help, but I tried both options and still received the same error.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.