Skip to content

Instantly share code, notes, and snippets.

@sgman sgman/Raw_Event Secret
Created Apr 14, 2015

Embed
What would you like to do?
Raw Event
{"severity": 4, "generator": {"build": "245427", "version": "6.2.1"}, "paging": {"perPage": 0, "total": 1, "offset": 0}, "ttl": 86400, "impact": "medium", "updated": "2015-04-10T11:48:04-07:00", "links": {}, "incident_id": "8b82d86a-b742-4f61-8f95-9c312015d2f4", "urgency": "low", "entry": [{"links": {"summary": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/summary", "control": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/control", "timeline": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/timeline", "results_preview": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/results_preview", "alternate": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "events": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/events", "results": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/results", "search.log": "/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011/search.log"}, "published": "2015-04-10T11:48:01.000-07:00", "name": "search index=*to* (EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625) AND Message=*Fail* NOT (Message=*XXXXX*) NOT (host=XXXX OR host=XXXX) | eval Account_Name=mvfilter(Account_Name!=\"-\") | stats count by host, Account_Name, Source_Network_Address, Logon_Type | search count>3", "updated": "2015-04-10T11:48:04.000-07:00", "author": "XXmeXX", "acl": {"modifiable": true, "perms": {"read": ["*", "XXmeXX"], "write": ["admin", "alert_manager", "power", "splunk-system-role", "XXmeXX", "to-inf"]}, "can_write": true, "owner": "XXmeXX", "sharing": "global", "app": "search", "ttl": "120"}, "id": "https://127.0.0.1:8089/services/search/jobs/scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "content": {"latestTime": "2015-04-10T11:48:00.000-07:00", "remoteSearch": "litsearch index=*to* ( EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625 ) AND Message=*Fail* NOT ( Message=*XXXXX* ) NOT ( host=XXXX OR host=XXXX ) | eval Account_Name=mvfilter(Account_Name!=\"-\") | addinfo type=count label=prereport_events | fields keepcolorder=t \"Account_Name\" \"Logon_Type\" \"Source_Network_Address\" \"host\" \"prestats_reserved_*\" \"psrsvd_*\" | prestats count by Account_Name Logon_Type Source_Network_Address host", "reportSearch": "stats count by host, Account_Name, Source_Network_Address, Logon_Type | search count>3", "label": "Test Alert", "isRemoteTimeline": false, "eventIsStreaming": true, "fieldMetadataEvents": {"Account_Name": {"type": "str"}}, "isFailed": false, "pid": "23430", "isTimeCursored": true, "performance": {"command.search.fieldalias": {"output_count": 4369, "input_count": 4369, "invocations": 43, "duration_secs": 0.145}, "dispatch.writeStatus": {"invocations": 6, "duration_secs": 0.01}, "dispatch.fetch": {"invocations": 53, "duration_secs": 1.246}, "command.eval": {"output_count": 41, "input_count": 41, "invocations": 52, "duration_secs": 0.052}, "command.stats.execute_input": {"invocations": 53, "duration_secs": 0.019}, "dispatch.check_disk_usage": {"invocations": 1, "duration_secs": 0.001}, "command.fields": {"output_count": 41, "input_count": 41, "invocations": 52, "duration_secs": 0.031}, "command.search.index.usec_1_8": {"invocations": 56882}, "command.search.index.usec_64_512": {"invocations": 25}, "command.search.calcfields": {"output_count": 4369, "input_count": 4369, "invocations": 43, "duration_secs": 0.034}, "dispatch.localSearch": {"invocations": 1, "duration_secs": 0.001}, "command.search.summary": {"invocations": 52, "duration_secs": 0.021}, "dispatch.stream.remote.XXXXips2XXXX": {"output_count": 4441, "input_count": 0, "invocations": 1, "duration_secs": 0.001}, "dispatch.stream.remote.XXXXips3XXXX": {"output_count": 4441, "input_count": 0, "invocations": 1, "duration_secs": 0.001}, "command.search.index.usec_8_64": {"invocations": 104}, "dispatch.stream.remote.XXXXips1XXXX": {"output_count": 4438, "input_count": 0, "invocations": 1, "duration_secs": 0.001}, "dispatch.evaluate.eval": {"invocations": 1, "duration_secs": 0.001}, "dispatch.evaluate.stats": {"invocations": 1, "duration_secs": 0.001}, "dispatch.parserThread": {"invocations": 51, "duration_secs": 0.051}, "command.search.lookups": {"output_count": 4369, "input_count": 4369, "invocations": 43, "duration_secs": 0.033}, "dispatch.evaluate.search": {"invocations": 2, "duration_secs": 0.192}, "dispatch.stream.remote.XXXXips3XXXX": {"output_count": 48697, "input_count": 0, "invocations": 9, "duration_secs": 0.339}, "command.prestats": {"output_count": 11, "input_count": 41, "invocations": 52, "duration_secs": 0.052}, "dispatch.stream.remote": {"output_count": 271438, "input_count": 0, "invocations": 51, "duration_secs": 1.757}, "command.search.rawdata": {"invocations": 43, "duration_secs": 1.204}, "dispatch.stream.remote.XXXXips5XXXX": {"output_count": 37313, "input_count": 0, "invocations": 7, "duration_secs": 0.267}, "command.addinfo": {"output_count": 41, "input_count": 41, "invocations": 52, "duration_secs": 0.051}, "dispatch.stream.remote.XXXXips4XXXX": {"output_count": 48052, "input_count": 0, "invocations": 9, "duration_secs": 0.322}, "dispatch.stream.remote.XXXXips2XXXX": {"output_count": 70323, "input_count": 0, "invocations": 13, "duration_secs": 0.445}, "command.stats.execute_output": {"invocations": 1, "duration_secs": 0.001}, "command.search.index.usec_512_4096": {"invocations": 1}, "command.search.kv": {"invocations": 43, "duration_secs": 0.273}, "command.search.tags": {"output_count": 41, "input_count": 41, "invocations": 43, "duration_secs": 0.043}, "dispatch.createdSearchResultInfrastructure": {"invocations": 1, "duration_secs": 0.238}, "startup.handoff": {"invocations": 9, "duration_secs": 7.92}, "command.search": {"output_count": 43, "input_count": 3, "invocations": 53, "duration_secs": 1.755}, "startup.configuration": {"invocations": 9, "duration_secs": 0.347}, "command.search.typer": {"output_count": 41, "input_count": 41, "invocations": 43, "duration_secs": 0.032}, "dispatch.evaluate": {"invocations": 1, "duration_secs": 0.191}, "dispatch.stream.local": {"invocations": 1, "duration_secs": 0.001}, "dispatch.stream.remote.XXXXips1XXXX": {"output_count": 53733, "input_count": 0, "invocations": 10, "duration_secs": 0.381}, "command.search.filter": {"invocations": 44, "duration_secs": 0.052}}, "cursorTime": "1969-12-31T16:00:00.000-08:00", "fieldMetadataStatic": {"Source_Network_Address": {"type": "unknown", "groupby_rank": "2"}, "host": {"type": "unknown", "groupby_rank": "0"}, "Account_Name": {"type": "unknown", "groupby_rank": "1"}, "Logon_Type": {"type": "unknown", "groupby_rank": "3"}}, "searchEarliestTime": 1428691080, "eventIsTruncated": true, "fieldMetadataResults": {"Source_Network_Address": {"type": "unknown", "groupby_rank": "2"}, "host": {"type": "unknown", "groupby_rank": "0"}, "Account_Name": {"type": "str", "groupby_rank": "1"}, "Logon_Type": {"type": "unknown", "groupby_rank": "3"}}, "messages": [], "isPreviewEnabled": false, "isGoodSummarizationCandidate": true, "isZombie": false, "earliestTime": "2015-04-10T11:38:00.000-07:00", "dispatchState": "DONE", "doneProgress": 1, "eventSearch": "search index=*to* (EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625) AND Message=*Fail* NOT (Message=*XXXXX*) NOT (host=XXXX OR host=XXXX) | eval Account_Name=mvfilter(Account_Name!=\"-\") ", "numPreviews": 0, "searchCanBeEventType": false, "defaultTTL": "600", "resultPreviewCount": 2, "resultCount": 2, "bundleVersion": "843221253326134765", "isSaved": false, "normalizedSearch": "litsearch index=*to* ( EventCode=529 OR EventCode=530 OR EventCode=531 OR EventCode=532 OR EventCode=533 OR EventCode=534 OR EventCode=535 OR EventCode=536 OR EventCode=537 OR EventCode=539 OR EventCode=4625 ) AND Message=*Fail* NOT ( Message=*XXXXX* ) NOT ( host=XXXX OR host=XXXX ) | eval Account_Name=mvfilter(Account_Name!=\"-\") | addinfo type=count label=prereport_events | fields keepcolorder=t \"Account_Name\" \"Logon_Type\" \"Source_Network_Address\" \"host\" \"prestats_reserved_*\" \"psrsvd_*\" | prestats count by Account_Name Logon_Type Source_Network_Address host", "ttl": 120, "eventCount": 41, "defaultSaveTTL": "604800", "eventSorting": "none", "scanCount": 4369, "isRealTimeSearch": false, "reduceSearch": "sistats count by host Account_Name Source_Network_Address Logon_Type", "searchProviders": ["XXXXesps1XXXX", "XXXXips1XXXX", "XXXXips2XXXX", "XXXXips3XXXX", "XXXXips4XXXX", "XXXXips5XXXX", "XXXXips1XXXX", "XXXXips2XXXX", "XXXXips3XXXX"], "isDone": true, "diskUsage": 167936, "searchLatestTime": 1428691680, "eventFieldCount": 0, "isSavedSearch": true, "isFinalized": false, "keywords": "eventcode::4625 eventcode::529 eventcode::530 eventcode::531 eventcode::532 eventcode::533 eventcode::534 eventcode::535 eventcode::536 eventcode::537 eventcode::539 index::*to* message::*fail*", "eventAvailableCount": 0, "delegate": "scheduler", "isBatchModeSearch": true, "statusBuckets": 0, "request": {"ui_dispatch_app": "search", "latest_time": "now", "auto_pause": "0", "index_earliest": "", "indexedRealtime": "", "max_time": "0", "ui_dispatch_view": "search", "buckets": "0", "spawn_process": "1", "lookups": "1", "reduce_freq": "10", "max_count": "500000", "rt_backfill": "0", "time_format": "%FT%T.%Q%:z", "auto_cancel": "0", "earliest_time": "-10m", "index_latest": ""}, "sid": "scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "resultIsStreaming": false, "priority": 5, "dropCount": 0, "runDuration": 2.06, "isPaused": false, "canSummarize": true}}], "result_id": 0, "job_id": "scheduler__XXmeXX__search__RMD5ada861e3c4e7d72f_at_1428691680_8011", "origin": "https://127.0.0.1:8089/services/search/jobs", "priority": "low"}
Show syntax highlighted
eventtype = alert_base eventtype = alert_metadata eventtype = nix_errors error
host = XXXXesps1XXXX
index = alerts-to-inf
source = alert_handler.py
sourcetype = alert_metadata
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.