Alerting

Is it possible to display the search condition that was met?

tjmurphyjr
Explorer

If I have a single alert search with multiple conditions that looks something like this:

index=X condition1 OR condition2 OR (condition3 AND subcondition1) OR condition4 OR condition5 OR (condition6 AND subcondition2)

Is there a way to display the actual conditional statement that was met without creating a separate alert for each condition?

In other words, does Splunk set some internal variable that holds the triggered condition (for example - "(condition3 AND subcondition1)") that is accessible to display in an email or notable event?

0 Karma

jacobpevans
Motivator

Greetings @tjmurphyjr,

Try doing it yourself. I highly doubt anything like that exists in Splunk.

| eval Matched_Conditions = "",
       Matched_Conditions = if ( condition1 , Matched_Conditions . "condition1", 'Matched_Conditions' ),
       Matched_Conditions = if ( condition2 , Matched_Conditions . "condition2", 'Matched_Conditions' ),
       Matched_Conditions = if ( condition3 AND subcondition1 , Matched_Conditions . "condition3 AND subcondition1", 'Matched_Conditions' ),
       Matched_Conditions = if ( condition4 , Matched_Conditions . "condition4", 'Matched_Conditions' ),
       Matched_Conditions = if ( condition5 , Matched_Conditions . "condition5", 'Matched_Conditions' ),
       Matched_Conditions = if ( condition6 AND subcondition2 , Matched_Conditions . "condition6 AND subcondition2", 'Matched_Conditions' ),

Cheers,
Jacob

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

tjmurphyjr
Explorer

Thanks @jacobpevans! Being a rookie at this I'm not sure how this would be applied to the alert search so that it actually fires. Would the "eval" act as the conditional statement that once met would then trigger the actions when true?

index=x |eval eval Matched_Conditions = "",
Matched_Conditions = if ( condition1...etc

| fields source, eventID, eventTime, Matched_Conditions
etc?

0 Karma

jacobpevans
Motivator

You are correct. Your full search would look like this:

index=X
condition1 OR
condition2 OR
(condition3 AND subcondition1) OR 
condition4 OR
condition5 OR
(condition6 AND subcondition2)
| eval Matched_Conditions = "",
        Matched_Conditions = if ( condition1 , Matched_Conditions . "condition1, ", 'Matched_Conditions' ),
        Matched_Conditions = if ( condition2 , Matched_Conditions . "condition2, ", 'Matched_Conditions' ),
        Matched_Conditions = if ( condition3 AND subcondition1 , Matched_Conditions . "condition3 AND subcondition1, ", 'Matched_Conditions' ),
        Matched_Conditions = if ( condition4 , Matched_Conditions . "condition4, ", 'Matched_Conditions' ),
        Matched_Conditions = if ( condition5 , Matched_Conditions . "condition5", 'Matched_Conditions' ),
        Matched_Conditions = if ( condition6 AND subcondition2 , Matched_Conditions . "condition6 AND subcondition2, ", 'Matched_Conditions' ),
| fields source, eventID, eventTime, Matched_Conditions

The only thing that the eval I provided would do is to generate a new field called "Matched_Conditions" which would show each condition from your base search that matched.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...