Alerting

How to prevent alerting on duplicate Windows reboot events that occur within a certain time period?

SplunkLunk
Path Finder

Good afternoon,

When a Windows server is rebooted it generates two events with the same EventID (1074) within one second of each other. I want to be alerted of a reboot, but I don't want to get two alerts per reboot. My search looks like:

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|table host,Data|rename host as "Windows Host", Data as "User"

Any suggestions on how to ignore the second event and just report on the first? I'd run the alert every five minutes to be on the constant lookout. The real issue might if multiple hosts reboot at the same time. Any advice would be helpful. Thanks.

0 Karma
1 Solution

somesoni2
Revered Legend

Since you're running your search every 5mins, I'm assuming your search time range also include 5min worth of data, so try like this to remove duplicate events keeping the one which came early.

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|stats earliest(Data) as Data by host|rename host as "Windows Host", Data as "User"

View solution in original post

somesoni2
Revered Legend

Since you're running your search every 5mins, I'm assuming your search time range also include 5min worth of data, so try like this to remove duplicate events keeping the one which came early.

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|stats earliest(Data) as Data by host|rename host as "Windows Host", Data as "User"

SplunkLunk
Path Finder

Thanks. I think this method will suit my needs. I've set it to run every two minutes looking for the last two minutes of data. There is the risk that a server would be rebooted more than once within that two minutes, but unlikely. Also, this is meant to server as a warning so if a server was rebooted multiple times I would be notified about it at least once. Thanks for the help.

aaraneta_splunk
Splunk Employee
Splunk Employee

Hi @SplunkLunk - If your question has been answered by @somesoni2, don't forget to resolve the post by clicking "Accept" below the answer. Thanks 🙂

0 Karma

sundareshr
Legend

How frequently do you run your alert? Have your configured trigger throttling (2 mins?)

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...