-
-
Save sgman/14985c08cedfdbccc523 to your computer and use it in GitHub Desktop.
Raw Event
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| {"severity": 4, "generator": {"build": "245427", "version": "6.2.1"}, "paging": {"perPage": 0, "total": 1, "offset": 0}, "ttl": 86400, "impact": "medium", "updated": "2015-04-10T11:48:04-07:00", "links": {}, "incident_id": "8b82d86a-b742-4f61-8f95-9c312015d2f4", "urgency": "low", "entry": [{"links": {"summary": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/summary", "control": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/control", "timeline": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/timeline", "results_preview": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/results_preview", "alternate": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "events": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/events", "results": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/results", "search.log": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/search.log"}, "published": "2015-04-10T11:48:01.000-07:00", "name": "search index=*to* (EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625) AND Message=*Fail* NOT (Message=*XXXXX*) NOT (host=XXXX OR host=XXXX) | eval Account_Name=mvfilter(Account_Name!=\"-\") | stats count by host, Account_Name, Source_Network_Address, Logon_Type | search count>3", "updated": "2015-04-10T11:48:04.000-07:00", "author": "XXmeXX", "acl": {"modifiable": true, "perms": {"read": ["*", "XXmeXX"], "write": ["admin", "alert_manager", "power", "splunk-system-role", "XXmeXX", "to-inf"]}, "can_write": true, "owner": "XXmeXX", "sharing": "global", "app": "search", "ttl": "120"}, "id": "https://127.0.0.1:8089/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "content": {"latestTime": "2015-04-10T11:48:00.000-07:00", "remoteSearch": "litsearch index=*to* ( EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625 ) AND Message=*Fail* NOT ( Message=*XXXXX* ) NOT ( host=XXXX OR host=XXXX ) | eval Account_Name=mvfilter(Account_Name!=\"-\") | addinfo type=count label=prereport_events | fields keepcolorder=t \"Account_Name\" \"Logon_Type\" \"Source_Network_Address\" \"host\" \"prestats_reserved_*\" \"psrsvd_*\" | prestats count by Account_Name Logon_Type Source_Network_Address host", "reportSearch": "stats count by host, Account_Name, Source_Network_Address, Logon_Type | search count>3", "label": "Test Alert", "isRemoteTimeline": false, "eventIsStreaming": true, "fieldMetadataEvents": {"Account_Name": {"type": "str"}}, "isFailed": false, "pid": "23430", "isTimeCursored": true, "performance": {"command.search.fieldalias": {"output_count": 4369, "input_count": 4369, "invocations": 43, "duration_secs": 0.145}, "dispatch.writeStatus": {"invocations": 6, "duration_secs": 0.01}, "dispatch.fetch": {"invocations": 53, "duration_secs": 1.246}, "command.eval": {"output_count": 41, "input_count": 41, "invocations": 52, "duration_secs": 0.052}, "command.stats.execute_input": {"invocations": 53, "duration_secs": 0.019}, "dispatch.check_disk_usage": {"invocations": 1, "duration_secs": 0.001}, "command.fields": {"output_count": 41, "input_count": 41, "invocations": 52, "duration_secs": 0.031}, "command.search.index.usec_1_8": {"invocations": 56882}, "command.search.index.usec_64_512": {"invocations": 25}, "command.search.calcfields": {"output_count": 4369, "input_count": 4369, "invocations": 43, "duration_secs": 0.034}, "dispatch.localSearch": {"invocations": 1, "duration_secs": 0.001}, "command.search.summary": {"invocations": 52, "duration_secs": 0.021}, "dispatch.stream.remote.XXXXips2XXXX": {"output_count": 4441, "input_count": 0, "invocations": 1, "duration_secs": 0.001}, "dispatch.stream.remote.XXXXips3XXXX": {"output_count": 4441, "input_count": 0, "invocations": 1, "duration_secs": 0.001}, "command.search.index.usec_8_64": {"invocations": 104}, "dispatch.stream.remote.XXXXips1XXXX": {"output_count": 4438, "input_count": 0, "invocations": 1, "duration_secs": 0.001}, "dispatch.evaluate.eval": {"invocations": 1, "duration_secs": 0.001}, "dispatch.evaluate.stats": {"invocations": 1, "duration_secs": 0.001}, "dispatch.parserThread": {"invocations": 51, "duration_secs": 0.051}, "command.search.lookups": {"output_count": 4369, "input_count": 4369, "invocations": 43, "duration_secs": 0.033}, "dispatch.evaluate.search": {"invocations": 2, "duration_secs": 0.192}, "dispatch.stream.remote.XXXXips3XXXX": {"output_count": 48697, "input_count": 0, "invocations": 9, "duration_secs": 0.339}, "command.prestats": {"output_count": 11, "input_count": 41, "invocations": 52, "duration_secs": 0.052}, "dispatch.stream.remote": {"output_count": 271438, "input_count": 0, "invocations": 51, "duration_secs": 1.757}, "command.search.rawdata": {"invocations": 43, "duration_secs": 1.204}, "dispatch.stream.remote.XXXXips5XXXX": {"output_count": 37313, "input_count": 0, "invocations": 7, "duration_secs": 0.267}, "command.addinfo": {"output_count": 41, "input_count": 41, "invocations": 52, "duration_secs": 0.051}, "dispatch.stream.remote.XXXXips4XXXX": {"output_count": 48052, "input_count": 0, "invocations": 9, "duration_secs": 0.322}, "dispatch.stream.remote.XXXXips2XXXX": {"output_count": 70323, "input_count": 0, "invocations": 13, "duration_secs": 0.445}, "command.stats.execute_output": {"invocations": 1, "duration_secs": 0.001}, "command.search.index.usec_512_4096": {"invocations": 1}, "command.search.kv": {"invocations": 43, "duration_secs": 0.273}, "command.search.tags": {"output_count": 41, "input_count": 41, "invocations": 43, "duration_secs": 0.043}, "dispatch.createdSearchResultInfrastructure": {"invocations": 1, "duration_secs": 0.238}, "startup.handoff": {"invocations": 9, "duration_secs": 7.92}, "command.search": {"output_count": 43, "input_count": 3, "invocations": 53, "duration_secs": 1.755}, "startup.configuration": {"invocations": 9, "duration_secs": 0.347}, "command.search.typer": {"output_count": 41, "input_count": 41, "invocations": 43, "duration_secs": 0.032}, "dispatch.evaluate": {"invocations": 1, "duration_secs": 0.191}, "dispatch.stream.local": {"invocations": 1, "duration_secs": 0.001}, "dispatch.stream.remote.XXXXips1XXXX": {"output_count": 53733, "input_count": 0, "invocations": 10, "duration_secs": 0.381}, "command.search.filter": {"invocations": 44, "duration_secs": 0.052}}, "cursorTime": "1969-12-31T16:00:00.000-08:00", "fieldMetadataStatic": {"Source_Network_Address": {"type": "unknown", "groupby_rank": "2"}, "host": {"type": "unknown", "groupby_rank": "0"}, "Account_Name": {"type": "unknown", "groupby_rank": "1"}, "Logon_Type": {"type": "unknown", "groupby_rank": "3"}}, "searchEarliestTime": 1428691080, "eventIsTruncated": true, "fieldMetadataResults": {"Source_Network_Address": {"type": "unknown", "groupby_rank": "2"}, "host": {"type": "unknown", "groupby_rank": "0"}, "Account_Name": {"type": "str", "groupby_rank": "1"}, "Logon_Type": {"type": "unknown", "groupby_rank": "3"}}, "messages": [], "isPreviewEnabled": false, "isGoodSummarizationCandidate": true, "isZombie": false, "earliestTime": "2015-04-10T11:38:00.000-07:00", "dispatchState": "DONE", "doneProgress": 1, "eventSearch": "search index=*to* (EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625) AND Message=*Fail* NOT (Message=*XXXXX*) NOT (host=XXXX OR host=XXXX) | eval Account_Name=mvfilter(Account_Name!=\"-\") ", "numPreviews": 0, "searchCanBeEventType": false, "defaultTTL": "600", "resultPreviewCount": 2, "resultCount": 2, "bundleVersion": "843221253326134765", "isSaved": false, "normalizedSearch": "litsearch index=*to* ( EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625 ) AND Message=*Fail* NOT ( Message=*XXXXX* ) NOT ( host=XXXX OR host=XXXX ) | eval Account_Name=mvfilter(Account_Name!=\"-\") | addinfo type=count label=prereport_events | fields keepcolorder=t \"Account_Name\" \"Logon_Type\" \"Source_Network_Address\" \"host\" \"prestats_reserved_*\" \"psrsvd_*\" | prestats count by Account_Name Logon_Type Source_Network_Address host", "ttl": 120, "eventCount": 41, "defaultSaveTTL": "604800", "eventSorting": "none", "scanCount": 4369, "isRealTimeSearch": false, "reduceSearch": "sistats count by host Account_Name Source_Network_Address Logon_Type", "searchProviders": ["XXXXesps1XXXX", "XXXXips1XXXX", "XXXXips2XXXX", "XXXXips3XXXX", "XXXXips4XXXX", "XXXXips5XXXX", "XXXXips1XXXX", "XXXXips2XXXX", "XXXXips3XXXX"], "isDone": true, "diskUsage": 167936, "searchLatestTime": 1428691680, "eventFieldCount": 0, "isSavedSearch": true, "isFinalized": false, "keywords": "eventcode::4625 eventcode::529 eventcode::530 eventcode::531 eventcode::532 eventcode::533 eventcode::534 eventcode::535 eventcode::536 eventcode::537 eventcode::539 index::*to* message::*fail*", "eventAvailableCount": 0, "delegate": "scheduler", "isBatchModeSearch": true, "statusBuckets": 0, "request": {"ui_dispatch_app": "search", "latest_time": "now", "auto_pause": "0", "index_earliest": "", "indexedRealtime": "", "max_time": "0", "ui_dispatch_view": "search", "buckets": "0", "spawn_process": "1", "lookups": "1", "reduce_freq": "10", "max_count": "500000", "rt_backfill": "0", "time_format": "%FT%T.%Q%:z", "auto_cancel": "0", "earliest_time": "-10m", "index_latest": ""}, "sid": "scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "resultIsStreaming": false, "priority": 5, "dropCount": 0, "runDuration": 2.06, "isPaused": false, "canSummarize": true}}], "result_id": 0, "job_id": "scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "origin": "https://127.0.0.1:8089/services/search/jobs", "priority": "low"} | |
| Show syntax highlighted | |
| eventtype = alert_base eventtype = alert_metadata eventtype = nix_errors error | |
| host = XXXXesps1XXXX | |
| index = alerts-to-inf | |
| source = alert_handler.py | |
| sourcetype = alert_metadata |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment