Alerting

How to prevent alerting on duplicate Windows reboot events that occur within a certain time period?

SplunkLunk
Path Finder

Good afternoon,

When a Windows server is rebooted it generates two events with the same EventID (1074) within one second of each other. I want to be alerted of a reboot, but I don't want to get two alerts per reboot. My search looks like:

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|table host,Data|rename host as "Windows Host", Data as "User"

Any suggestions on how to ignore the second event and just report on the first? I'd run the alert every five minutes to be on the constant lookout. The real issue might if multiple hosts reboot at the same time. Any advice would be helpful. Thanks.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Since you're running your search every 5mins, I'm assuming your search time range also include 5min worth of data, so try like this to remove duplicate events keeping the one which came early.

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|stats earliest(Data) as Data by host|rename host as "Windows Host", Data as "User"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Since you're running your search every 5mins, I'm assuming your search time range also include 5min worth of data, so try like this to remove duplicate events keeping the one which came early.

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|stats earliest(Data) as Data by host|rename host as "Windows Host", Data as "User"

SplunkLunk
Path Finder

Thanks. I think this method will suit my needs. I've set it to run every two minutes looking for the last two minutes of data. There is the risk that a server would be rebooted more than once within that two minutes, but unlikely. Also, this is meant to server as a warning so if a server was rebooted multiple times I would be notified about it at least once. Thanks for the help.

aaraneta_splunk
Splunk Employee
Splunk Employee

Hi @SplunkLunk - If your question has been answered by @somesoni2, don't forget to resolve the post by clicking "Accept" below the answer. Thanks 🙂

0 Karma

sundareshr
Legend

How frequently do you run your alert? Have your configured trigger throttling (2 mins?)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...