Splunk Search

SPlunk SNMP TRAP to get IP address in Search Query

sahils
New Member

We have modified spectrum alerts for unix and it’s been sent to snmptrap and its working. We don’t have ip address for windows machine in splunk. We have to figure out a way to get ip address in to splunk for those windows machines either by batch scripts or to try using wmi.conf.

Can you please help for the same, HOw we can get IP address in WIndows server.

Thanks,
Sahil

Tags (1)
0 Karma

woodcock
Esteemed Legend

Add 3 lines before you last 4 so that your last 7 lines look like this:

| lookup dnslook clientip AS host OUTPUT clienthost
| eval host=coalesce(clienthost, host)
| fields - clienthost
| outputlookup win_memalert.csv | search action!="nothing"
| eval alert_type="Windows Memory Alert" | eval 1=alert_type, 2=host, 3=used_percent, 4=threshold, 5=action, 6=unique_id
| fields 1 2 3 4 5 6
| createsnmptrap
0 Karma

sahils
New Member

We run Query and add 3 lines also add number 7 IP address in fields but not geeting IP data

index=perfmon sourcetype="Perfmon:LogicalDisk" source="Perfmon:LogicalDisk" counter="% Free Space" |dedup host |eval unique_id=md5(_raw) |search [inputlookup win_disk.csv|fields host]
|eventstats avg(Value) as disk_free_space by host
|eval used_percent= (100-disk_free_space)
|append [inputlookup win_disk.csv]
|eval threshold=case(used_percent<95, "Stable", used_percent>=95 AND used_percent<98,"Warning", used_percent>=98, "Critical")
|stats first(used_percent) as used_percent, last(used_percent) as last_used_percent, first(threshold) as threshold, last(threshold) as last_threshold, last(unique_id) as unique_id, first(_time) as _time by host
|eval state=case(used_percent<95, "stable", used_percent<95 AND threshold=last_threshold, "still_stable" , used_percent>=95 AND used_percent<98 AND threshold=last_threshold, "existing", used_percent>=98 AND threshold=last_threshold, "existing", used_percent>=98 AND threshold!=last_threshold, "shift_critical", used_percent<98 AND used_percent>=95 AND threshold!=last_threshold, "shift_warning")
|search state!="still_stable"
|eval action=case(state="new", "post", state="existing", "nothing", state="stable", "clear", state="shift_warning", "recede", state="shift_critical", "escalate")
|table host, used_percent, last_used_percent, threshold, last_threshold, unique_id, _time, state, action
| append [search index=perfmon sourcetype="Perfmon:LogicalDisk" source="Perfmon:LogicalDisk" counter="% Free Space" |dedup host | search NOT
[
|inputlookup win_disk.csv|fields host
]
|eval unique_id=md5(_raw)
|eventstats avg(Value) as disk_free_space by host
|eval used_percent= (100-disk_free_space)
| where used_percent>=95
| eval threshold=case(used_percent<95,"Stable",used_percent>=95 AND used_percent<98,"Warning", used_percent>=98,"Critical")
|fillnull state value="new"|eval action=case(state="new", "post")
| eval title="win_disk_Used_Exceeds_Perc_by_Host"
|table host, used_percent, last_used_percent, threshold, last_threshold, unique_id, _time, state, action]
|outputlookup win_disk.csv
|eval alert_type="Windows Disk Alert" | eval 1=alert_type, 2=host, 3=used_percent, 4=threshold, 5=action, 6=unique_id, 7=ip
|fields 1 2 3 4 5 6 7
|createsnmptrap

100 Per Page Format Preview
1 2 3 4 5 6 7 _time
Windows Disk Alert uslv-dapp-bsm02 95.705941 Warning nothing 832eb3f3cfdeec78fcd72e0131e740fb 2017-04-04 04:01:20

Please suggest

Thanks,
Sahil

0 Karma

woodcock
Esteemed Legend
0 Karma

sahils
New Member

Hello,

Below are the query and if we add dns its not working

index=perfmon sourcetype="Perfmon:Memory" source="Perfmon:Memory" counter="% Committed Bytes In Use"
|dedup host|eval unique_id=md5(_raw)
|search [inputlookup win_memalert.csv|fields host]
|eventstats avg(Value) as used_percent by host
|append [inputlookup win_memalert.csv]
|eval threshold=case(used_percent<70, "Stable", used_percent>=70 AND used_percent<85,"Warning", used_percent>=85, "Critical")
|stats first(used_percent) as used_percent, last(used_percent) as last_used_percent, first(threshold) as threshold, last(threshold) as last_threshold, last(unique_id) as unique_id, first(_time) as _time by host
|eval state=case(used_percent<70 AND threshold=last_threshold, "still_stable", used_percent<70, "stable", used_percent>=70 AND used_percent<85 AND threshold=last_threshold, "existing", used_percent >= 85 AND threshold=last_threshold, "existing", used_percent>=85 AND  threshold!=last_threshold, "shift_critical", used_percent<85 AND used_percent>=70 AND threshold!=last_threshold, "shift_warning")
|search state!="still_stable" 
|eval action=case(state="new", "post", state="existing", "nothing", state="stable", "clear", state="shift_warning", "recede", state="shift_critical", "escalate")
|table _time, host, used_percent, last_used_percent, threshold, last_threshold, unique_id, state, action
|append [search index=perfmon sourcetype="Perfmon:Memory" source="Perfmon:Memory" counter="% Committed Bytes In Use" | dedup host |search NOT 
[
|inputlookup win_memalert.csv|fields host
]
|eval unique_id=md5(_raw)
|eventstats avg(Value) as used_percent by host
|where used_percent>70
|eval threshold=case(used_percent<70, "Stable", used_percent>=70 AND used_percent<85,"Warning", used_percent>=85, "Critical")
|fillnull state value="new"|eval action=case(state="new", "post")
|eval title="win_Memory_Exceeds_Percent_by_Host"
|table _time, host, used_percent, last_used_percent, threshold, last_threshold, unique_id, state, action]
|outputlookup win_memalert.csv | search action!="nothing"
|eval alert_type="Windows Memory Alert" | eval 1=alert_type, 2=host, 3=used_percent, 4=threshold, 5=action, 6=unique_id
|fields 1 2 3 4 5 6
|createsnmptrap |

Thanks,
Sahil

0 Karma

sahils
New Member

Please help us for the same.

Thanks,
Sahil

0 Karma

sahils
New Member

Please update and help for the same .

Thanks,
Sahil

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...