Alerting

How do I create an alert that will search for two separate string values with the OR condition inside the search?

Curiuu
Engager

I'm creating an alert that will search for two separate string values with the OR condition inside the search. Is there a way to setup the alert condition to fire for 'If the second event is not found within 5 minutes of the first event, fire the alert.'?  The events happen anytime within a 6 hour window, so having it search every 5 minutes for a count under 2 would fire alerts constantly.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this running over the previous 10 minutes (or longer).

<search string1 or string2>
``` Ensure events in chronological order ```
| sort 0 _time
``` Get timeframe of search ```
| addinfo
``` Capture time of event if string 1 present (however you determine that) ```
| eval string1_time=if(<string1 in event>, _time, null())
``` Capture time of event if string 2 present (however you determine that) and after the first 5 minutes ```
| eval string2_time=if(<string2 in event> AND _time >= info_min_time + 300, _time, null())
``` Track latest times of string 1 through the event stream ```
| streamstats max(string1_time) as last_string1_time
``` Mark string 2 events as not OK if no previous string 1 or if previous string 1 too far in the past ```
| eval NOK=if(isnotnull(string2_time), if(isnotnull(last_string1_time) AND string2_time - last_string1_time <= 300, 0, 1), null())
``` Remove timing for string 1 events if in last 5 minutes ```
| eval string1_time=if(isnotnull(string1_time) AND string1_time <= info_max_time - 300, string1_time, null())
``` Count bad string 2 events and get last string 1 time prior to last 5 minutes ```
| stats sum(NOK) as NOK max(string1_time) as last_string1_time
``` Alert condition (number of results > 0) if any bad string 2 events or no string 2 events but there were string 1 events prior to last 5 minutes ```
| where NOK > 0 OR (isnull(NOK) AND isnotnull(last_string1_time))

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this running over the previous 10 minutes (or longer).

<search string1 or string2>
``` Ensure events in chronological order ```
| sort 0 _time
``` Get timeframe of search ```
| addinfo
``` Capture time of event if string 1 present (however you determine that) ```
| eval string1_time=if(<string1 in event>, _time, null())
``` Capture time of event if string 2 present (however you determine that) and after the first 5 minutes ```
| eval string2_time=if(<string2 in event> AND _time >= info_min_time + 300, _time, null())
``` Track latest times of string 1 through the event stream ```
| streamstats max(string1_time) as last_string1_time
``` Mark string 2 events as not OK if no previous string 1 or if previous string 1 too far in the past ```
| eval NOK=if(isnotnull(string2_time), if(isnotnull(last_string1_time) AND string2_time - last_string1_time <= 300, 0, 1), null())
``` Remove timing for string 1 events if in last 5 minutes ```
| eval string1_time=if(isnotnull(string1_time) AND string1_time <= info_max_time - 300, string1_time, null())
``` Count bad string 2 events and get last string 1 time prior to last 5 minutes ```
| stats sum(NOK) as NOK max(string1_time) as last_string1_time
``` Alert condition (number of results > 0) if any bad string 2 events or no string 2 events but there were string 1 events prior to last 5 minutes ```
| where NOK > 0 OR (isnull(NOK) AND isnotnull(last_string1_time))

Curiuu
Engager

Got this to work, thank you so much!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...