Alerting

If the event count goes below 20 for multiple destination ip

NDabhi21
Explorer

I would like generate alert if no event for mentioned destination List for last 30 min.

I have tried below but is not work.

Index=_firewall sourcetype="f5:bigip:asm:syslog" dest_ip="10.10.10.20" earliest= -30m latest=now
| stats count by dest_ip,Service
| eval count=if (count <=20,0,0)

 

Labels (1)
Tags (1)
0 Karma

gcusello
Esteemed Legend

Hi @NDabhi21,

please try this:

index=_firewall sourcetype="f5:bigip:asm:syslog" dest_ip="10.10.10.20" earliest= -30m latest=now
| stats count by dest_ip Service
| where count<=20

then you have to configure your alert to trigger if there are results (results >0).

Ciao.

Giuseppe

NDabhi21
Explorer

For Multiple Destination, Is lookup table will work in same SPL Query 

|lookup IPLIST.csv ip AS dest_ip

 

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...