https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255558#M76531 <P>If your search is working, here's the documentation for creating an alert</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Definescheduledalerts">http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Definescheduledalerts</A></P> Thu, 26 May 2016 21:23:41 GMT sundareshr 2016-05-26T21:23:41Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255555#M76528 <P>Hi, </P> <P>I'm trying to search for users that access the SAME system more than 5 times in 10 minutes, in order to identify any abused usage of the system. I'm hoping to create an alert for such an event.</P> <P>Currently, I've come up with this:</P> <PRE><CODE>...| stats dc(System_ID) count by userID | where count&gt;5 </CODE></PRE> <P>But I'm not sure if it's correct and how to search within the 10 minute time frame. Please help me out. I'm quite new to Splunk Enterprise. </P> <P>Thank you very much! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 17 May 2016 03:09:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255555#M76528 qiaojing 2016-05-17T03:09:16Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255556#M76529 <P>Try this</P> <PRE><CODE>.... | bin span=10m _time as time | stats dc(userID) as NoAttempts by time System_ID | where NoAttempts&gt;=5 </CODE></PRE> Tue, 17 May 2016 12:29:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255556#M76529 sundareshr 2016-05-17T12:29:13Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255557#M76530 <P>Hi this is my latest code where the threshold is the 95th percentile. </P> <PRE><CODE>eventtype="centralizedlog"(hasAccess=Y) | bin span=20m _time | stats dc(System_ID) count by userID, _time| eventstats perc95(count) as adnorm | where count&gt;adnorm | rename count as "Num of Log Events"| fields - adnorm - dc(System_ID) </CODE></PRE> <P>Anyone knows how I can scheduled an alert that alerts me each time such event occurs? Thank you. </P> Tue, 24 May 2016 08:30:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255557#M76530 qiaojing 2016-05-24T08:30:39Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255558#M76531 <P>If your search is working, here's the documentation for creating an alert</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Definescheduledalerts">http://docs.splunk.com/Documentation/Splunk/6.4.1/Alert/Definescheduledalerts</A></P> Thu, 26 May 2016 21:23:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-users-that-accessed-the-same-system-more-than/m-p/255558#M76531 sundareshr 2016-05-26T21:23:41Z