Knowledge Management

Realtime search based on macro and changing the macro

phoenixdigital
Builder

Hi All,

We have a realtime search which will fire alerts based on some thresholds which we currently store in macros

So I will dumb down the realtime savedsearch as an example

sourcetype="myData" | head 2 | eval testMacro = `macroThreshold` | where testMacro > 120

We have setup page for our app which allows modification of these macros (can also be done via management)

macros.conf looks something like this

[macroThreshold]
definition = 100

Now the saved search is a realtime search and we are hoping that if someone changes the definition of macroThreshold it will be updated in the realtime search. This doesnt appear to work and it appears to be fixed as the value the macro was when the search was started.

Does anyone have an alternate way for changing this threshold and having it used by the realtime search?

A subsearch will not work as you cannot have realtime subsearches.

Is there a way to force/kill the realtime search to restart using this new value?

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

I've not tested it but a lookup might work. Say you have a lookup threshold.csv defined as

sourcetype,threshold
myData,100

Then your realtime search can be written as

sourcetype="myData" 
| head 2 
| lookup update=true threshold.csv sourcetype OUTPUT threshold
| where threshold > 120

The update=true will explicitly cause realtime searches to pull in updates to the lookup.

Sadly there is probably no good way to manage the lookup file from manager directly.

0 Karma

phoenixdigital
Builder

Ah nice to know about lookup and realtime searches thanks.

As you stated its probably not ideal as it means we need some other interface (possibly external to Splunk) for updating the CSV file.

I suppose I could alter the setup_handler.py to do it though.

Ideally though a way to kick a saved realtime search into restarting would be great.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...