topic Re: complex stats to trigger on count of events in Splunk Search

complex stats to trigger on count of events

dm2 — Wed, 28 Feb 2024 11:56:12 GMT

I have this rule, I need it to trigger when results / count of events is greater than 4 but the "Trigger Condition" did not work.
Is there something I can add to the query ?

Re: complex stats to trigger on count of events

gcusello — Wed, 28 Feb 2024 11:59:25 GMT

Hi @dm2,

please, share your search in text mode, otherwise it's more difficoult to help you.

You can insert the text using the "Insert/Edit code sample" button.

Ciao.

Giuseppe

Re: complex stats to trigger on count of events

dm2 — Wed, 28 Feb 2024 13:04:03 GMT

| stats count dc("File Name") as "File Name Count" first(_time) as _time, values(host) as host, values("File Type") as "File Type", values(Policy) as Policy, values(SHA256) as SHA256, values("Block Reason") as "Block Reason", values(Blocked) as Blocked by "File Name"

Re: complex stats to trigger on count of events

inventsekar — Wed, 28 Feb 2024 13:32:01 GMT

Hi @dm2 .. the SPL looks good and working fine also(as per the image).

the trigger condition says the result greater than 4 and the image shows result 1. so the trigger condition was not triggered.

are you saying that, when the result is greater than 4 also the trigger condition not triggering?

Re: complex stats to trigger on count of events

dm2 — Wed, 28 Feb 2024 13:42:27 GMT

I saying that the rule needs to trigger when events > 4, and the 'Trigger Condition' did not work.

This is the rule that triggered (triggered on one event):

Re: complex stats to trigger on count of events

inventsekar — Wed, 28 Feb 2024 14:39:24 GMT

ok something is not clear.

the trigger condition is results count greater than 4, then trigger/run the trigger conditions.

1) do you say that when the results are greater than 4, but still the trigger did not work.

2) on your latest reply, you got only one result, but the trigger condition ran successfully ya?

Can you pls attach the trigger conditions screenshot pls.