How to create an alert when more than 10 events have appeared in one hour?

[josedgaravito]

Hi, splunkers.

I need to generate an alert when more than 10 events related to the same camera are generated in 1 hour. I have tried with count and other commands but it has not been possible.

the examples of events are:

[2019-06-03 01:22:40] Cámara CAM004: La cámara esta presentando problemas {"Workstation":"192.168.10.2","Camara":"172.16.8.12","estadoSeñal":"Camera Connection Status(Lost)"}.

When a camera fails, they are presented around 20 events in a time range of one hour.

[jnudell_2]

Hi @josedgaravito ,

You could try this as well:

 ... [ your base search ] ... earliest=-1h

| rex "Cámara (?<camara>[^:]+):"

| stats count by camara

| where count > 10

This should show results for camara having more than 10 events in the time frame specified.

[Vijeta]

@josedgaravito What is the field name for Camera, do you need to extract the fields or are they already extracted? How does your search query look.

[josedgaravito]

It has no name, they differ by the IP, the field of the camera is IPCamara

[Vijeta]

@josedgaravito

<your search>|bin _time span=1h | stats count by IPCamera _time| where count > 10

[DavidHourani]

Hola @josedgaravito,

I see what you want to do, have a look here, should be a very similar solution :
https://answers.splunk.com/answers/751158/how-to-find-out-falied-login-attemptseventcode4625-1.html#...

Your query should be something like this :

  yourBaseSearch
 | bin _time span=1h 
 | stats count by cameraID,_time
 | where count > 10

Let me know if you need more help.

Cheers,
David