topic Re: Correct way to do count over time in Alerting

Correct way to do count over time

Vantine — Wed, 13 Dec 2023 15:11:17 GMT

Trying to set up an alert to show any log in that has had 500 log on failures in under 30 min.

Here is what I currently have (with non relevant data changed)

index=* sourcetype=* action=failure EventCode=4771 OR EventCode=4776 | bucket _time span=30m | stats count by user | where count>500

I want to make sure this is correct.

Thanks!

Re: Correct way to do count over time

gcusello — Wed, 13 Dec 2023 13:44:29 GMT

Hi @Vantine,

yes it's correct.

You're speaking of windows log so you could simplify (and make faster) your search in this way:

index=wineventlog sourcetype=wineventlog EventCode=4771 OR EventCode=4776 | timechart span=30m count by user | where count>500

Ciao.

Giuseppe

Re: Correct way to do count over time

Vantine — Wed, 13 Dec 2023 17:24:02 GMT

Wasnt getting results, so I went longer and smaller errors. Still not getting anything.

Here is how I have it

index=eits_wineventlog_security sourcetype=WinEventLog EventCode=4771 OR EventCode=4776

| timechart span=60m count by user
| where count>5

I know for sure we have had enough failures to at least get a few.

Thanks

Re: Correct way to do count over time

gcusello — Wed, 13 Dec 2023 18:15:10 GMT

Hi @Vantine,

don't use timechart:

index=eits_wineventlog_security sourcetype=WinEventLog (EventCode=4771 OR EventCode=4776) | bin span=60m _time | stats count BY user _time | where count>5

Ciao.

Giuseppe