Alerting

Help creating an alert based on number of events per field

bigfatyeastroll
Path Finder

We're looking to create an alert based on the number of failures based on a certain field (clientIP) per certain time frame.

here is the search so far:

sourcetype="access_combined" POST 401 "/cas/login" | stats count by clientip

Basically, we only want to be alerted when the number of events from any unique clientIP hits 10 per minute. 

We have the alert to trigger if the number of results is greater than 9.

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If your search period is one minute, try this

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| where count > 9

Or if it is larger and you want to check the count in 1 minute buckets, try this

sourcetype="access_combined" POST 401 "/cas/login"
| timechart span=1m count by clientip
| untable _time clientip count
| where count > 9

 

nadlurinadluri
Communicator

Not sure if I understand it correctly, but if you are trying to trigger an alert if the no.of events is equal to 10, you can append the same condition in the query and in the alert conditions, trigger the alert only if you get any results.

sourcetype="access_combined" POST 401 "/cas/login"
| stats count by clientip
| search clientip=10

 

Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...