All Apps and Add-ons

Splunk Alert Exclude Previous Search Result

huaw828
New Member

Hi,

I have a Splunk search which detect some potential attack Ips.
The alert scheduled every 4 hours and detect the offending IPs for last 24 hour which tried to login but failed for multiple times.
The result could be something like the following example:
ip failed_count
123.456.789.123 100
222.333.544.111 200

The problem is that, let's say the alert triggered at 8:00 am for the above result.
At 12:00 am, the alert triggered again with the following result:

ip failed_count
123.456.789.123 100
222.333.544.111 200
444.555.666.777 220

How could i exclude the previous result which already existing and only put the new one?
What i need for the alert at 12:00 am is only show:
ip failed_count
444.555.666.777 220

I tried to use Throttle to suppress results containing field value of ip, but this only works as per result, which means i would got multiple emails.

Please help, thanks in advance !

0 Karma

dineshraj9
Builder

You can try loading the results for each day in a lookup using outputlookup command and before output lookup add a check if the current result has no results that match any entry in the lookup.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...