Alerting

Help creating an alert based on number of events per field

bigfatyeastroll
Path Finder

We're looking to create an alert based on the number of failures based on a certain field (clientIP) per certain time frame.

here is the search so far:

sourcetype="access_combined" POST 401 "/cas/login" | stats count by clientip

Basically, we only want to be alerted when the number of events from any unique clientIP hits 10 per minute. 

We have the alert to trigger if the number of results is greater than 9.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If your search period is one minute, try this

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| where count > 9

Or if it is larger and you want to check the count in 1 minute buckets, try this

sourcetype="access_combined" POST 401 "/cas/login"
| timechart span=1m count by clientip
| untable _time clientip count
| where count > 9

 

nadlurinadluri
Communicator

Not sure if I understand it correctly, but if you are trying to trigger an alert if the no.of events is equal to 10, you can append the same condition in the query and in the alert conditions, trigger the alert only if you get any results.

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| search clientip=10

 

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...