Alerting

Dedup by time

arkonner
Path Finder

I am using the search below to determine the account locked out - It works fine but as result I received more than a single account locked-out events from at list two domain controllers between 2 seconds - Should be possible to use a dedup by time to avoid the same status over 5/10 seconds.

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND  Account_Name!=Anonymous   | eval Account_Name = mvindex(Account_Name,1)   | eval Security_ID = mvindex(Security_ID,1)  | timechart span=1h limit=20 useother=f count by Account_Name
Tags (3)
0 Karma

koshyk
Super Champion

I would do a stats rather than a dedup as it is much efficient & fast

0 Karma

gokadroid
Motivator

If all the data in the event seems duplicate please try to see if dedup _raw at the beginning solves your problem. If still the duplicate events exist it means there is something different between raw data of these two events even though the specific data you seek might look duplicate.

Doing a dedup over _time might not solve the issue since you mention that after 2 seconds the event reappears (which means time itself is different). Try dedup over the fields which you see are coming as duplicate rather than time which itself is 2sec different to previous duplicate event.

0 Karma

arkonner
Path Finder

The same event has been recorded by more than one domain controller - " count by Account_Name" is showing two events coming from server1 and server2 - in closing time - I am looking to eliminate the duplication if this append in a 5/10 sec time windows - If the same user i still strying to perform a login the new account_locked out will appear.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...