topic Re: Using events from last 30 minutes find duplicates from last 4 hours in Splunk Search

How to use events from last 30 minutes find duplicates from last 4 hours?

solaced — Fri, 07 Apr 2023 17:13:19 GMT

Could someone help me with such a query? I am running a scheduled search every 30 minutes which aims to find duplicate registrations from the last 30 minutes, that were also used when compared to the last 4 hours.

Since it runs search every 30 minutes, I cannot just search using a 4 hour window, else it will keep triggering an alert every 30 minutes for 4 hours basically.

index=myindex userRegistration earliest=-4h latest=now

|stats count by dc(userName) as UserCount

| where UserCount>1

Re: Using events from last 30 minutes find duplicates from last 4 hours

gcusello — Fri, 07 Apr 2023 07:47:49 GMT

Hi @solaced,

you could try something like this:

index=myindex userRegistration earliest=-4h latest=now | eval Period=if(now()-_time>1800,"Last 30 minutes","Other time") | stats dc(Period) AS Period_count count by userName | where Period_count>1

In this way you have only events present in both last 30 minutes and in before time, you don't have multiple events in the same period.

Ciao.

Giuseppe

Re: Using events from last 30 minutes find duplicates from last 4 hours

solaced — Sat, 08 Apr 2023 03:24:20 GMT

Thank you so much!!

Re: Using events from last 30 minutes find duplicates from last 4 hours

gcusello — Sat, 08 Apr 2023 05:41:18 GMT

Hi @solaced ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉