I have two lookup tables: notablesIp.csv and criticalAsset.csv notableIP.csv ip attack 1.1.1.1 Ransomware 1.1.1.2 Malware CriticalAsset.csv 1.1.1.2 1.1.1.3 Desired results 1.1.1.2 Malware How would I write a search that would tell me a notable happened on a critical asset? They share a common field called IP. ... View more

index=notable |rename src as ip | stats count by ip | JOIN type=inner ip [search index="abcd" "tags.Dev:"cluster1 OR index="abcd" "tags.Dev:"=cluster2 | stats count by ip] if ip is in notable index and cluster1 return ip AND if ip in notable index and cluster2 return ip ... View more

We have a script that pulls the disk info than the Universalforwarder reads the data and send to Splunk. With the query below I can generate a table with a clean output but now I need an alert on diskusage in above 80% utilization. In the example I would like DB1 C drive current condition to fire an triggered Splunk alert. index=popeye host=DB1 OR DB2 sourcetype="DiskInfo*" | rex "C: \s+\d+\.\d\s+(?<Percent_C_FS>\S+)" | rex "D: \s+\d+\.\d\s+(?<Percent_D_FS>\S+)" dudup host | stats count by host Percent_C_FS Percent_D_FS host Percent_C_FS Percent_D_FS DB1 15 75 DB2 55 65 ... View more