Alerting

How do I create an alert that will search for two separate string values with the OR condition inside the search?

Curiuu
Engager

I'm creating an alert that will search for two separate string values with the OR condition inside the search. Is there a way to setup the alert condition to fire for 'If the second event is not found within 5 minutes of the first event, fire the alert.'?  The events happen anytime within a 6 hour window, so having it search every 5 minutes for a count under 2 would fire alerts constantly.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this running over the previous 10 minutes (or longer).

<search string1 or string2>
``` Ensure events in chronological order ```
| sort 0 _time
``` Get timeframe of search ```
| addinfo
``` Capture time of event if string 1 present (however you determine that) ```
| eval string1_time=if(<string1 in event>, _time, null())
``` Capture time of event if string 2 present (however you determine that) and after the first 5 minutes ```
| eval string2_time=if(<string2 in event> AND _time >= info_min_time + 300, _time, null())
``` Track latest times of string 1 through the event stream ```
| streamstats max(string1_time) as last_string1_time
``` Mark string 2 events as not OK if no previous string 1 or if previous string 1 too far in the past ```
| eval NOK=if(isnotnull(string2_time), if(isnotnull(last_string1_time) AND string2_time - last_string1_time <= 300, 0, 1), null())
``` Remove timing for string 1 events if in last 5 minutes ```
| eval string1_time=if(isnotnull(string1_time) AND string1_time <= info_max_time - 300, string1_time, null())
``` Count bad string 2 events and get last string 1 time prior to last 5 minutes ```
| stats sum(NOK) as NOK max(string1_time) as last_string1_time
``` Alert condition (number of results > 0) if any bad string 2 events or no string 2 events but there were string 1 events prior to last 5 minutes ```
| where NOK > 0 OR (isnull(NOK) AND isnotnull(last_string1_time))

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this running over the previous 10 minutes (or longer).

<search string1 or string2>
``` Ensure events in chronological order ```
| sort 0 _time
``` Get timeframe of search ```
| addinfo
``` Capture time of event if string 1 present (however you determine that) ```
| eval string1_time=if(<string1 in event>, _time, null())
``` Capture time of event if string 2 present (however you determine that) and after the first 5 minutes ```
| eval string2_time=if(<string2 in event> AND _time >= info_min_time + 300, _time, null())
``` Track latest times of string 1 through the event stream ```
| streamstats max(string1_time) as last_string1_time
``` Mark string 2 events as not OK if no previous string 1 or if previous string 1 too far in the past ```
| eval NOK=if(isnotnull(string2_time), if(isnotnull(last_string1_time) AND string2_time - last_string1_time <= 300, 0, 1), null())
``` Remove timing for string 1 events if in last 5 minutes ```
| eval string1_time=if(isnotnull(string1_time) AND string1_time <= info_max_time - 300, string1_time, null())
``` Count bad string 2 events and get last string 1 time prior to last 5 minutes ```
| stats sum(NOK) as NOK max(string1_time) as last_string1_time
``` Alert condition (number of results > 0) if any bad string 2 events or no string 2 events but there were string 1 events prior to last 5 minutes ```
| where NOK > 0 OR (isnull(NOK) AND isnotnull(last_string1_time))

Curiuu
Engager

Got this to work, thank you so much!

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...