Search with a count of events in a time window by host

[ruffieuxlu]

Hello,

I am new with Splunk and I have to do some searches to prevent attacks and things like that. I have around 45 servers (Linux or Windows) which send logs to my Splunk server.

I need your help to have an example of a search that I can't do with my current knowledge.

I need to search every authentifications fails. If there is more than 5 fails in less than 5 minutes in the same host then I send an email or an alert to Nagios. Is it possible to do that, and if yes, how ?

Thank you for your help !

(Sorry if there is some english mistakes)

[lukeh]

You can use Splunk For Nagios to Schedule Saved Searches in Splunk to send alerts to Nagios. I wrote the app for that exact purpose, and it also allows you to search Nagios alerts and notifications and trend problems over time. Over 40 field extractions are included, as well as 6 Saved Searches, and an Advanced Dashboard featuring recent Warning and Critical Alerts.

http://splunk-base.splunk.com/apps/22374/splunk-for-nagios

[thall79]

Maybe something like this for a search:

(your search for fails) | bucket _time span=5m | stats count by user,host,_time | search count>4

After that save the search and set it up as an alert.

Hope this helps

Travis.

[thall79]

So you just want to setup a search to run every 5 minutes and report on the previous 5 minutes to alert of any failures greater than 5. How about this: (your search for fails) earliest=-5min | stats count by user,host,_time | search count>4

[ruffieuxlu]

It is not far, but this solution returns all the events in 5min windows. I need to see only the events in the past 5min. In example if I do that :
(search) | bucket _time span=5m | stats count by user,host,_time | search count>4 | sort -_time | head 1
I have one event but from yesterday at 22h PM, so if I schedule this search every 5min, Nagios will receive plenty alerts for this event.
I need to see if there is an event in the past 5min or not. If there is, I create an alert, if not everything is okay.