Alerting

What is the best way to set up a scheduled search to alert if there are more than 5 events from a specific user?

CREVITCH
Path Finder

I am looking to do a search every minute, and see if there are more than 5 events from a specific user. If so, I need to trigger an alert. I have this running as a scheduled search every minute, and it seems to be working. Is there a better way to do this? Should I be scheduling the search every hour and look for login events >5 in 1 minute windows? If so, how would I do that.

My current search looks like this

user=*   | eventstats count by user | where count > 5

start time -6m
finish time -5m
run every minute

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.

user=* | timechart span=1m count | where count> 5

Start time:  -20m@m
Finish time:  -15m@m

Cron: 5-59/15 * * * *

If you can allow delay of alert to 1 hour or so, run this hourly.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.

user=* | timechart span=1m count | where count> 5

Start time:  -20m@m
Finish time:  -15m@m

Cron: 5-59/15 * * * *

If you can allow delay of alert to 1 hour or so, run this hourly.

CREVITCH
Path Finder

Thanks! Exactly what I was looking for.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...