Alerting

What is the best way to set up a scheduled search to alert if there are more than 5 events from a specific user?

CREVITCH
Path Finder

I am looking to do a search every minute, and see if there are more than 5 events from a specific user. If so, I need to trigger an alert. I have this running as a scheduled search every minute, and it seems to be working. Is there a better way to do this? Should I be scheduling the search every hour and look for login events >5 in 1 minute windows? If so, how would I do that.

My current search looks like this

user=*   | eventstats count by user | where count > 5

start time -6m
finish time -5m
run every minute

0 Karma
1 Solution

somesoni2
Revered Legend

It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.

user=* | timechart span=1m count | where count> 5

Start time:  -20m@m
Finish time:  -15m@m

Cron: 5-59/15 * * * *

If you can allow delay of alert to 1 hour or so, run this hourly.

View solution in original post

somesoni2
Revered Legend

It all depends upon the delay that is acceptable for your alert. Right now the delay is 5 min. So if you can allow delay for 20 mins, then run the search every 15 min, run a timechart for count and alert if any minute have count more than 5.

user=* | timechart span=1m count | where count> 5

Start time:  -20m@m
Finish time:  -15m@m

Cron: 5-59/15 * * * *

If you can allow delay of alert to 1 hour or so, run this hourly.

CREVITCH
Path Finder

Thanks! Exactly what I was looking for.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...