Alerting

Dedup by time

arkonner
Path Finder

I am using the search below to determine the account locked out - It works fine but as result I received more than a single account locked-out events from at list two domain controllers between 2 seconds - Should be possible to use a dedup by time to avoid the same status over 5/10 seconds.

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND  Account_Name!=Anonymous   | eval Account_Name = mvindex(Account_Name,1)   | eval Security_ID = mvindex(Security_ID,1)  | timechart span=1h limit=20 useother=f count by Account_Name
Tags (3)
0 Karma

koshyk
Super Champion

I would do a stats rather than a dedup as it is much efficient & fast

0 Karma

gokadroid
Motivator

If all the data in the event seems duplicate please try to see if dedup _raw at the beginning solves your problem. If still the duplicate events exist it means there is something different between raw data of these two events even though the specific data you seek might look duplicate.

Doing a dedup over _time might not solve the issue since you mention that after 2 seconds the event reappears (which means time itself is different). Try dedup over the fields which you see are coming as duplicate rather than time which itself is 2sec different to previous duplicate event.

0 Karma

arkonner
Path Finder

The same event has been recorded by more than one domain controller - " count by Account_Name" is showing two events coming from server1 and server2 - in closing time - I am looking to eliminate the duplication if this append in a 5/10 sec time windows - If the same user i still strying to perform a login the new account_locked out will appear.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...