How to check if certain events occurs N consecutive times?

[SplunkExplorer]

Hi Splunkers, I have to build a rule, based on Windows Logs (XML ones), that must check this:

Notify me is there are at least 3 consecutive occurreces of EventID 4776 from a list of host. Tje desiderd output must show:

• Host
• Number of consecutive events
• User/account associated to  events

So for example, if we have that

• Host A has 4 consecutive events of EventID 4776 for user "Admin"
• Host B has 19 consecutive events of EventID 4776 for user "Test"
• Host C has 2 consecutive events of EventID 4776 for user "Joker"
• Host D has 3 Events of EvenID 4776, but only 2 consecutive; than has another different event and only after this another occurrence of 4776 for user "Hello"

Host C don't match the consecutive count clause and must be escluded; same for Host D, because he has 3 events but not consecutive. The expected output is:

Host	User	N. of consecutive events
A	Admin	4
B	Test	19

What get me in stuck here is how to check that events are consecutive.Any suggestion?

[gcusello]

Hi @SplunkExplorer,

let me understand: when you sai consecutive events, are you meaning events in the reference period or that between these events athere isn't any othe event?

In the first case, you can run a simple search like the following :

index=wineventlog Eventcode=4776
| stats count BY host user
| where count>3

if the second the solution is more complex, I''l think to it.

Ciao.

Giuseppe

[SplunkExplorer]

Hi @gcusello, it is the second option you mentioned: no other events between the desired one must be present.

For example:

15:00:00: Eventd ID 4776 for user gcusello
15:00:01: Eventd ID 4776 for user gcusello
15:00:02: Eventd ID 4776 for user gcusello

is fine, while:

15:00:00: Eventd ID 4776 for user gcusello
15:00:01: Eventd ID 4776 for user gcusello
15:00:02: Eventd ID 4625 for user gcusello
15:00:03: Eventd ID 4776 for user gcusello

it isn't.

[isoutamo · Accepted solution]

I think that this is doable with https://docs.splunk.com/Documentation/Splunk/9.0.5/SearchReference/Streamstats

Just use reset_before/after which suite better for you. 

| streamstats reset_before="EventID!=4776" count by host user EventID
| where count > 3