topic Re: How to create an alert when more than 10 events have appeared in one hour? in Alerting

How to create an alert when more than 10 events have appeared in one hour?

josedgaravito — Fri, 14 Jun 2019 16:01:56 GMT

Hi, splunkers.

I need to generate an alert when more than 10 events related to the same camera are generated in 1 hour. I have tried with count and other commands but it has not been possible.

the examples of events are:

[2019-06-03 01:22:40] Cámara CAM004: La cámara esta presentando problemas {"Workstation":"192.168.10.2","Camara":"172.16.8.12","estadoSeñal":"Camera Connection Status(Lost)"}.

When a camera fails, they are presented around 20 events in a time range of one hour.

Re: How to create an alert when more than 10 events have appeared in one hour?

DavidHourani — Fri, 14 Jun 2019 16:18:53 GMT

Hola @josedgaravito,

I see what you want to do, have a look here, should be a very similar solution :
https://answers.splunk.com/answers/751158/how-to-find-out-falied-login-attemptseventcode4625-1.html#answer-751164

Your query should be something like this :

  yourBaseSearch
 | bin _time span=1h 
 | stats count by cameraID,_time
 | where count > 10

Let me know if you need more help.

Cheers,
David

Re: How to create an alert when more than 10 events have appeared in one hour?

Vijeta — Fri, 14 Jun 2019 16:20:10 GMT

@josedgaravito What is the field name for Camera, do you need to extract the fields or are they already extracted? How does your search query look.

Re: How to create an alert when more than 10 events have appeared in one hour?

jnudell_2 — Fri, 14 Jun 2019 16:59:52 GMT

Hi @josedgaravito ,

You could try this as well:

 ... [ your base search ] ... earliest=-1h

| rex "Cámara (?<camara>[^:]+):"

| stats count by camara

| where count > 10

This should show results for camara having more than 10 events in the time frame specified.

Re: How to create an alert when more than 10 events have appeared in one hour?

josedgaravito — Fri, 14 Jun 2019 17:08:33 GMT

It has no name, they differ by the IP, the field of the camera is IPCamara

Re: How to create an alert when more than 10 events have appeared in one hour?

Vijeta — Fri, 14 Jun 2019 17:21:42 GMT

@josedgaravito

<your search>|bin _time span=1h | stats count by IPCamera _time| where count > 10