topic Re: Dedup by time in Alerting

Dedup by time

arkonner — Mon, 12 Dec 2016 16:12:18 GMT

I am using the search below to determine the account locked out - It works fine but as result I received more than a single account locked-out events from at list two domain controllers between 2 seconds - Should be possible to use a dedup by time to avoid the same status over 5/10 seconds.

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND  Account_Name!=Anonymous   | eval Account_Name = mvindex(Account_Name,1)   | eval Security_ID = mvindex(Security_ID,1)  | timechart span=1h limit=20 useother=f count by Account_Name

Re: Dedup by time

gokadroid — Mon, 12 Dec 2016 16:47:59 GMT

If all the data in the event seems duplicate please try to see if dedup _raw at the beginning solves your problem. If still the duplicate events exist it means there is something different between raw data of these two events even though the specific data you seek might look duplicate.

Doing a dedup over _time might not solve the issue since you mention that after 2 seconds the event reappears (which means time itself is different). Try dedup over the fields which you see are coming as duplicate rather than time which itself is 2sec different to previous duplicate event.

Re: Dedup by time

koshyk — Mon, 12 Dec 2016 21:03:54 GMT

I would do a stats rather than a dedup as it is much efficient & fast

Re: Dedup by time

arkonner — Tue, 29 Sep 2020 12:06:43 GMT

The same event has been recorded by more than one domain controller - " count by Account_Name" is showing two events coming from server1 and server2 - in closing time - I am looking to eliminate the duplication if this append in a 5/10 sec time windows - If the same user i still strying to perform a login the new account_locked out will appear.