Getting Data In

dedup by time

gba8912
Explorer

hello,

 

I am trying to dedup events from successful authorizations in Splunk. Currently, our windows systems make about 4 events per authorization but we only want to see one. I would like to dedup based on time,  0.5 seconds for each event. Here is my current search: 

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.user=* (Authentication.src=* OR Authentication.dest=*) Authentication.action=failure by Authentication.user, Authentication.src, Authentication.dest

| rename "Authentication.*" as "*"

| eval source&destination=mvappend(src,dest)

| eventstats dc(source&destination) AS host_count by user

| where host_count >= 1

| sort - host_count

| table source&destination, user

| head 250

 

How can i add a dedup by time here?

Thanks!

Labels (5)
0 Karma

to4kawa
SplunkTrust
SplunkTrust

I don't know, because I haven't looked at the logs.

0 Karma

to4kawa
SplunkTrust
SplunkTrust

 

| tstats summariesonly=true allow_old_summaries=true count from datamodel=Authentication.Authentication where Authentication.user=* (Authentication.src=* OR Authentication.dest=*) Authentication.action=failure by Authentication.user, Authentication.src, Authentication.dest

 

This result doesn't include the time.

>our windows systems make about 4 events per authorization
What are these?

0 Karma

gba8912
Explorer

An example is event 4624, when this event is triggered in our DC, it make 4 events for that single sign on by a user or system. I don't know why this is but that's how its happening. We then get 4 events in Splunk. We made a dashboard with the above search and want to filter out the duplicates in order to view only one event per successful authorization. 

I know time is not added, but we want to add it. I was hoping to add something that dedups events say within 0.1 seconds. This way it filters out 3 out of the 4 events that happened at the exact same time. Is this possible?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!