Alerting

How to create an alert based on the count of unique values for a field?

m0ps
Explorer

Hello all!

I'm newbie in Splunk and I'm trying to figure out how to create an alert based on count of unique field values.

I have field src_mac and I need to trigger an alert each time the same value appears more than 4 times in search results.

Example log:

Apr 20 16:06:41 dhcp1 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp1 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:41 dhcp2 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp2 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:33 dhcp1 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp1 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:33 dhcp2 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases
dest_int = 198.18.2.1 dhcp_message = DHCPDISCOVER host = dhcp2 src_mac = a0:d3:c1:63:37:16
Apr 20 16:06:30 dhcp1 dhcpd: DHCPDISCOVER from a0:d3:c1:63:37:16 via 198.18.2.1: peer holds all free leases

Also I need to suppress results containing same field value for 10 minutes.
Could anybody provide example?

Thanks in advance,
Maxim

0 Karma
1 Solution

somesoni2
Revered Legend

How about this

your base search with required time range | stats count by src_mac | where count>4

View solution in original post

PreetiKa
Engager

Under Trigger Conditions->Trigger Alert When-> Number of Results -> is greater than -> "4" or whatever value you want to keep. And Supress Triggering for should be 600 seconds or 10minutes

0 Karma

somesoni2
Revered Legend

How about this

your base search with required time range | stats count by src_mac | where count>4

m0ps
Explorer

Yes, I've tried this, and it looks like works fine, but what about alert settings?
Trigger Condition

Is that correct?

0 Karma

somesoni2
Revered Legend

If you want to get alert for a src_mac once per 10 min (if it's happening every 10 min), the the "Suppress triggering for" should be 10 mins (600 sec). Othere than that it looks good. May be update the Earliest and Latest to -5m@m and @m so that you capture the whole minute and don't loose data that to be considered.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>