Correlation search looking for at least x events within y seconds

Sven — Wed, 24 May 2023 20:17:37 GMT

Thanks in advance for your time and assistance.

I have a Splunk Enterprise Security correlation search intended to trigger when there are at least 20 events having the same values of FieldA and FieldB within 60 seconds.

Consistent with multiple resources within Splunk docs, I am using the below search. The correlation search runs once every 30 minutes.

(Main search) | bin _time span=60s | stats count by FieldA FieldB | where count > 19

This should be straightforward, but the search has fired when there are 20 or more log entries with the same FieldA and FieldB values during the entire 30 minutes since the last correlation search, but definitely not 20 instances within the defined bin window of 60s.

Is there some caveat of using the bin command that I am unaware of? Is there a more reliable method to achieve the same objective?

_Thanks_

Re: Correlation search looking for at least x events within y seconds

richgalloway — Wed, 24 May 2023 20:56:41 GMT

Tell stats to group results by time as well as the other fields.

(Main search) | bin _time span=60s | stats count by _time FieldA FieldB | where count > 19

Re: Correlation search looking for at least x events within y seconds

Sven — Wed, 24 May 2023 21:06:38 GMT

Of course. Thank you.

topic Re: Correlation search looking for at least x events within y seconds in Splunk Enterprise Security

Correlation search looking for at least x events within y seconds

Re: Correlation search looking for at least x events within y seconds

Re: Correlation search looking for at least x events within y seconds