Alerting

How do I create an alert that will search for two separate string values with the OR condition inside the search?

Curiuu
Engager

I'm creating an alert that will search for two separate string values with the OR condition inside the search. Is there a way to setup the alert condition to fire for 'If the second event is not found within 5 minutes of the first event, fire the alert.'?  The events happen anytime within a 6 hour window, so having it search every 5 minutes for a count under 2 would fire alerts constantly.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this running over the previous 10 minutes (or longer).

<search string1 or string2>
``` Ensure events in chronological order ```
| sort 0 _time
``` Get timeframe of search ```
| addinfo
``` Capture time of event if string 1 present (however you determine that) ```
| eval string1_time=if(<string1 in event>, _time, null())
``` Capture time of event if string 2 present (however you determine that) and after the first 5 minutes ```
| eval string2_time=if(<string2 in event> AND _time >= info_min_time + 300, _time, null())
``` Track latest times of string 1 through the event stream ```
| streamstats max(string1_time) as last_string1_time
``` Mark string 2 events as not OK if no previous string 1 or if previous string 1 too far in the past ```
| eval NOK=if(isnotnull(string2_time), if(isnotnull(last_string1_time) AND string2_time - last_string1_time <= 300, 0, 1), null())
``` Remove timing for string 1 events if in last 5 minutes ```
| eval string1_time=if(isnotnull(string1_time) AND string1_time <= info_max_time - 300, string1_time, null())
``` Count bad string 2 events and get last string 1 time prior to last 5 minutes ```
| stats sum(NOK) as NOK max(string1_time) as last_string1_time
``` Alert condition (number of results > 0) if any bad string 2 events or no string 2 events but there were string 1 events prior to last 5 minutes ```
| where NOK > 0 OR (isnull(NOK) AND isnotnull(last_string1_time))

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this running over the previous 10 minutes (or longer).

<search string1 or string2>
``` Ensure events in chronological order ```
| sort 0 _time
``` Get timeframe of search ```
| addinfo
``` Capture time of event if string 1 present (however you determine that) ```
| eval string1_time=if(<string1 in event>, _time, null())
``` Capture time of event if string 2 present (however you determine that) and after the first 5 minutes ```
| eval string2_time=if(<string2 in event> AND _time >= info_min_time + 300, _time, null())
``` Track latest times of string 1 through the event stream ```
| streamstats max(string1_time) as last_string1_time
``` Mark string 2 events as not OK if no previous string 1 or if previous string 1 too far in the past ```
| eval NOK=if(isnotnull(string2_time), if(isnotnull(last_string1_time) AND string2_time - last_string1_time <= 300, 0, 1), null())
``` Remove timing for string 1 events if in last 5 minutes ```
| eval string1_time=if(isnotnull(string1_time) AND string1_time <= info_max_time - 300, string1_time, null())
``` Count bad string 2 events and get last string 1 time prior to last 5 minutes ```
| stats sum(NOK) as NOK max(string1_time) as last_string1_time
``` Alert condition (number of results > 0) if any bad string 2 events or no string 2 events but there were string 1 events prior to last 5 minutes ```
| where NOK > 0 OR (isnull(NOK) AND isnotnull(last_string1_time))

Curiuu
Engager

Got this to work, thank you so much!

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...