Getting Data In

dedup by time

gba8912
Explorer

hello,

 

I am trying to dedup events from successful authorizations in Splunk. Currently, our windows systems make about 4 events per authorization but we only want to see one. I would like to dedup based on time,  0.5 seconds for each event. Here is my current search: 

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.user=* (Authentication.src=* OR Authentication.dest=*) Authentication.action=failure by Authentication.user, Authentication.src, Authentication.dest

| rename "Authentication.*" as "*"

| eval source&destination=mvappend(src,dest)

| eventstats dc(source&destination) AS host_count by user

| where host_count >= 1

| sort - host_count

| table source&destination, user

| head 250

 

How can i add a dedup by time here?

Thanks!

Labels (5)
0 Karma

to4kawa
Ultra Champion

I don't know, because I haven't looked at the logs.

0 Karma

to4kawa
Ultra Champion

 

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.user=* (Authentication.src=* OR Authentication.dest=*) Authentication.action=failure by Authentication.user, Authentication.src, Authentication.dest

 

This result doesn't include the time.

>our windows systems make about 4 events per authorization
What are these?

0 Karma

gba8912
Explorer

An example is event 4624, when this event is triggered in our DC, it make 4 events for that single sign on by a user or system. I don't know why this is but that's how its happening. We then get 4 events in Splunk. We made a dashboard with the above search and want to filter out the duplicates in order to view only one event per successful authorization. 

I know time is not added, but we want to add it. I was hoping to add something that dedups events say within 0.1 seconds. This way it filters out 3 out of the 4 events that happened at the exact same time. Is this possible?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...