How to prevent alerting on duplicate Windows reboot events that occur within a certain time period?

[SplunkLunk]

Good afternoon,

When a Windows server is rebooted it generates two events with the same EventID (1074) within one second of each other. I want to be alerted of a reboot, but I don't want to get two alerts per reboot. My search looks like:

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|table host,Data|rename host as "Windows Host", Data as "User"

Any suggestions on how to ignore the second event and just report on the first? I'd run the alert every five minutes to be on the constant lookout. The real issue might if multiple hosts reboot at the same time. Any advice would be helpful. Thanks.

[somesoni2 · Accepted solution]

Since you're running your search every 5mins, I'm assuming your search time range also include 5min worth of data, so try like this to remove duplicate events keeping the one which came early.

index=* host=* source=WinEventLog:System | xmlkv|search EventID=1074|stats earliest(Data) as Data by host|rename host as "Windows Host", Data as "User"

[SplunkLunk]

Thanks. I think this method will suit my needs. I've set it to run every two minutes looking for the last two minutes of data. There is the risk that a server would be rebooted more than once within that two minutes, but unlikely. Also, this is meant to server as a warning so if a server was rebooted multiple times I would be notified about it at least once. Thanks for the help.

[aaraneta_splunk]

Hi @SplunkLunk - If your question has been answered by @somesoni2, don't forget to resolve the post by clicking "Accept" below the answer. Thanks 🙂

[sundareshr]

How frequently do you run your alert? Have your configured trigger throttling (2 mins?)