https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238268#M4810 <P>That's it! I completely overlooked the eventstats command and it's obvious now. Thanks! </P> Fri, 13 Jan 2017 20:02:16 GMT afarmer 2017-01-13T20:02:16Z https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238265#M4807 <P>I use the haversine formula to search for users who have logged into resources within a short period of time in the last 24 hours. I have a scheduled report set to run every hour and it looks back at the past 24 hours across our authentication logs. The report works perfectly, but here is the issue.</P> <P>Let's say my scheduled report will run at 9:00AM.<BR /> A particular username is shown as logging in from Atlanta, Georgia, and logging in from Paris, France, within a 5 minute time frame.<BR /> My scheduled report runs every hour, so this user will appear as logging in from both cities.</P> <P>However, since my report runs every hour, this user will continue to appear each hour until the 24 hour time frame has passed. As you can tell, if I set up an alert, I'll receive many emails each hour.</P> <P>What is the best way to configure the report/alert so that this user will only appear once and not every time the report runs? The alert settings don't seem to have an affect. </P> <P>Thanks in advance.</P> Fri, 13 Jan 2017 14:27:17 GMT https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238265#M4807 afarmer 2017-01-13T14:27:17Z https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238266#M4808 <P>What's the current query/logic that you're using? Are you checking if a user has logged from multiple cities/resources with a specified interval?</P> Fri, 13 Jan 2017 17:25:00 GMT https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238266#M4808 somesoni2 2017-01-13T17:25:00Z https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238267#M4809 <P>Just add this to the end of your search:</P> <PRE><CODE>| eventstats latest(_time) AS mostRecentTime BY user | where mostRecentTime &gt;= (now() - 3600) | fields - mostRecentTime </CODE></PRE> <P>This will keep only those groups of events where at least one of them happened in the last hour.</P> Fri, 13 Jan 2017 17:59:06 GMT https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238267#M4809 woodcock 2017-01-13T17:59:06Z https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238268#M4810 <P>That's it! I completely overlooked the eventstats command and it's obvious now. Thanks! </P> Fri, 13 Jan 2017 20:02:16 GMT https://community.splunk.com/t5/Reporting/How-to-configure-a-Haversine-scheduled-report-so-that-a-user/m-p/238268#M4810 afarmer 2017-01-13T20:02:16Z